Writeup Upd — Pdfy Htb

After running John, we obtain the password for the pdfy user: ilovepdfy .

The HTTP service running on port 8080 appears to be a REST API for managing PDFs. pdfy htb writeup upd

Using the information gathered during the enumeration phase, we attempt to exploit the PDF converter service. We use a malicious file to trigger a reverse shell, which allows us to gain initial access to the machine. After running John, we obtain the password for

Enter your ngrok URL (e.g., https://abc123.ngrok.io/index.html ) into the PDFy application. We use a malicious file to trigger a

: Try to point the URL to http://localhost . If the server renders its own internal page, you have confirmed SSRF.

: In many HTB "PDF" challenges, common engines include wkhtmltopdf , dompdf , or PDFKit . 🚀 Step 2: Identification & Exploitation

uname -a