0

I am working on a CTF called Internal. I know there are walkthroughs available but I am trying not to look at them for the time being and try and work through things myself. The admin page that is the apparent target is http://10.10.240.106/phpmyadmin/

I came across a link which seems ripe for some SSRF the URL being:

http://10.10.240.106/phpmyadmin/url.php?url=https%3A%2F%2Fwww.phpmyadmin.net%2F

I was thinking of trying to work with the url=... part. The default link redirects to www.phpmyadmin.net via the following requests:

Initial request

GET /phpmyadmin/url.php?url=https%3A%2F%2Fwww.phpmyadmin.net%2F HTTP/1.1
Host: 10.10.240.106
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: pmaCookieVer=5; pma_collation_connection=utf8mb4_unicode_ci; pma_lang=en_GB; phpMyAdmin=itkf1j7nmuo62r2iur67etvdbi
Connection: close

Initial Response

HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 03:47:21 GMT
Server: Apache/2.4.29 (Ubuntu)
Expires: Sun, 03 Dec 2023 03:47:21 +0000
Cache-Control: no-store, no-cache, must-revalidate,  pre-check=0, post-check=0, max-age=0
Last-Modified: Sun, 03 Dec 2023 03:47:21 +0000
X-ob_mode: 1
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;;style-src 'self' 'unsafe-inline' ;referrer no-referrer;img-src 'self' data:  *.tile.openstreetmap.org;
X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data:  *.tile.openstreetmap.org;
X-WebKit-CSP: default-src 'self' ;script-src 'self'  'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data:  *.tile.openstreetmap.org;
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: noindex, nofollow
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 194
Connection: close
Content-Type: text/html; charset=utf-8

<script type='text/javascript'>
            window.onload=function(){
                window.location='https://www.phpmyadmin.net/';
            }
        </script>Taking you to the target site.

It then sends another GET request to www.phpmyadmin.net as expected.

So I figured I'd try and test out the URL parameter using www.google.com so I modified the initial request to:

Initial Request

GET /phpmyadmin/url.php?url=http%3A%2F%2Fwww.google.com HTTP/1.1
Host: 10.10.240.106
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: pmaCookieVer=5; pma_collation_connection=utf8mb4_unicode_ci; pma_lang=en_GB; phpMyAdmin=itkf1j7nmuo62r2iur67etvdbi
Connection: close

Initial respoinse

HTTP/1.1 302 Found
Date: Sun, 03 Dec 2023 03:45:42 GMT
Server: Apache/2.4.29 (Ubuntu)
Expires: Sun, 03 Dec 2023 03:45:42 +0000
Cache-Control: no-store, no-cache, must-revalidate,  pre-check=0, post-check=0, max-age=0
Last-Modified: Sun, 03 Dec 2023 03:45:42 +0000
X-ob_mode: 1
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;;style-src 'self' 'unsafe-inline' ;referrer no-referrer;img-src 'self' data:  *.tile.openstreetmap.org;
X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data:  *.tile.openstreetmap.org;
X-WebKit-CSP: default-src 'self' ;script-src 'self'  'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data:  *.tile.openstreetmap.org;
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: noindex, nofollow
Pragma: no-cache
Location: /phpmyadmin/
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=utf-8

However the 2nd request now becomes:

GET /phpmyadmin/ HTTP/1.1
Host: 10.10.240.106
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: pmaCookieVer=5; pma_collation_connection=utf8mb4_unicode_ci; pma_lang=en_GB; phpMyAdmin=itkf1j7nmuo62r2iur67etvdbi
Connection: close

This just redirects back to the original page. I am stumped as to what is going on here? Can someone help me with why the first request redirects to the intended page but the second one does not?

2
  • 1
    The differences are a) that you attempt to use http not https, b) have not given a path in the URL, i.e. just google.com instead of google.com/ c) use a different URL. I recommend that you try variations of these differences to find out what is actually expected by url.php. Dec 3, 2023 at 6:19
  • It turns out this was not the way in. I got in via another method and it seems like there was a whitelist in use so nothing else would have worked anyway. Dec 5, 2023 at 5:58

1 Answer 1

1

In addition to what Steffen's comment mentions, you should note that there's no sign whatsoever of SSRF here. That is, the server does not, at any point, appear to making its own request; instead, it is returning a page that uses JS to navigate to the specified url (in the default case) or using a HTTP 302 redirect response to a "safe" page on the same host (in the modified parameter case). Both of these methods cause additional client-side requests, but neither is (visibly) causing any server-side requests.

Assuming you are able to control the url parameter at all without getting the "safe" redirect, you might be able to use an XSS exploit, but that wouldn't do you any good unless there's some other user to deploy it against. Otherwise, what you're looking at here is - at best - an open redirect, which is less exciting (as a vulnerability) than XSS (since XSS trivially allows open redirect), and still only matters against another user.

1
  • You are right. The place I learned my SSRF didn't do a great job of explaining SSRF combined with open redirects. I looked up some things on PortSwigger and some youtube videos and now have a better grasp of it. So my initial question is based on a flawed understanding of the principle. Dec 5, 2023 at 5:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .