Leak /etc/passwd to retrieve the flag
Hack The Box
Edit descriptionapp.hackthebox.com
Challenge Description
Welcome to PDFy, the exciting challenge where you turn your favorite web pages into portable PDF documents! It’s your chance to capture, share, and preserve the best of the internet with precision and creativity. Join us and transform the way we save and cherish web content! NOTE: Leak /etc/passwd to get the flag!
Overview
The attack surface is quite minimal. We’re presented with a homepage where we can input a webpage URL, which is then processed by a backend API. The application takes the URL, converts the webpage into a PDF, and displays it in the browser.
Interacting with the Application
Our goal is to leak the contents of /etc/passwd. To begin, I started experimenting with various payloads to see how the application reacts — specifically, whether it gives any informative error messages or indicates the underlying technology used.
Here are some sample request/responses during the initial testing phase:
From the error messages, we discover a crucial detail:
The backend uses wkhtmltopdf to generate PDFs from the user-supplied URLs.
Exploiting wkhtmltopdf to Access Local Files
Now that we know the app uses wkhtmltopdf, I looked into potential vulnerabilities or misconfigurations involving this tool.
While researching known vulnerabilities in wkhtmltopdf, I came across several potential attack vectors—including local file inclusion, insecure protocol handling, and command injection. Among these, one particularly effective technique stood out: wkhtmltopdf follows HTTP redirects, even when they point to local files. This behavior can be exploited to trick the backend into reading files like /etc/passwd.
Redirecting to a Local File
To exploit this, I created a simple PHP page that issues a Location header redirecting to a local file path:
<?php
header("Location: file:///etc/passwd");
exit;
?>
I hosted this PHP file on a server and submitted its URL to the PDFy application.
Once processed, the resulting PDF contained the contents of /etc/passwd.
Success — we’ve achieved arbitrary file read via a redirect-based SSRF exploiting the behavior of wkhtmltopdf.
Conclusion
This challenge was a neat example of chaining information disclosure with backend misconfiguration:
- Discovered use of
wkhtmltopdfvia error messages - Identified that it follows redirects (even to local files)
- Exploited this to leak
/etc/passwdand obtain the flag
It demonstrates the importance of sanitizing user input and restricting file access in tools like wkhtmltopdf.
Thanks for reading!