Description

Leverage SSRF on the host utils.edu.stf (10.124.1.237).

To get the flag, access the internal address via port 9732 (http://127.0.0.1:9732).

Add utils.edu.stf (10.124.1.237) to the /etc/hosts file.

After browsing the utils.edu.stf, we land on a PDF converter page that includes an option to convert external URLs to PDF.

image.png

This functionality is a common attack vector for Server-Side Request Forgery (SSRF)

Based on the challenge instructions, we have to exploit this vulnerability by using SSRF to access the internal server at the specified localhost address.

image.png

And we get the flag

image.png