Going down the SSRF rabbit hole with a Gopher and a Claude.

Recon

Nmap Scan

sudo nmap -sS <IP> -T5

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http

Fuzzing /

dirsearch -u <IP>

403    14B   http://10.128.163.205/management/

Initial Access

Vulnerability Detection and Analysis

While looking around the Caido history, I noticed the following request when I clicked to see a PDF preview:

GET /preview.php?url=http%3A%2F%2Fcvssm1%2Fpdf%2Florem.pdf HTTP/1.1

So the question that instantly came up in my mind was “can I access the management page that i found during the recon?”. Yes, I could, and just like that I confirmed an SSRF.

Internal Host Recon

I then started the recon for the internal host - just after spending a few minutes attacking the internal aws intance at 169.254.169.254 - to see if I could find some new internal services using Caido. I found that port 10000 was open.

Next.js authorization bypass

Upon hitting this page, I realised the goal was to visit the /customapi endpoint that was protected. After some research, I found the page was using next.js due to request it was making and also this article online ¹ on how to bypass Next.js auth using the following header.

x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

But a problem arose: how could I send a header to the internal services through an SSRF endpoint? The answer was the Gopher protocol.

Creating an SSRF Gopher tunnel with Claude :)

The answer to my problem was to use the Gopher protocol² supported by the server. It is a legacy protocol that sends raw bytes, so I could send the headers alongside the request and thus get them to hit the internal endpoint. And so I asked Claude to build me just that: tunnel_proxy.py I needed to change the IP and port inside the script to the target machine’s IP and service port, either 80 or 10000, and run it with:

python tunnel_proxy.py

Now, every call that I made to it via Caido created a Gopher payload and sent it to the SSRF endpoint.

Getting the first flag

Now that I had the proxy working, I had to send a request to /customapi with the header, and that was it. I got some credentials, librarian:L1br4r1AN!! … I wondered where that would go…

Getting the last flag

For the last flag, I needed to input those credentials on the first login page at /management. So I pointed my proxy to port 80 and inserted the credentials. After that, I was met with an MFA page, and I also received a strange cookie. URL decoding it, I saw the following:

auth_token=O:9:"AuthToken":1:{s:9:"validated";b:0;}

What if I changed that zero to a one? It worked, that was it… I just bypassed MFA and got the flag.

Sources