The Leaked List Writeup

Story

Red Racks, a hacker group, has released a web application that helps in checking whether a website is hacked by them or not. Are you smart enough to hack the hackers?

Solution

The application gives two input forms, one for project name and one for URL.

Anything given other than the exact payload will result in server error. If we inspect the elements we can see a string.

This gives a hint that the application is using redis and also the redis password is hard coded there.

The challenge is a plain SSRF so we need to craft the URL with redis commands using gopher protocol.

The payload is:

        gopher://redis:6379/AAUTH%20YreInIpkyDge1wYNlDYB1vbnTIGYAe%0a%0dKEYS%20*%20%0a%0dGET%20FLAG%0a%0dQUIT
    

Written by

Manieendar Mohan

Cyber Security Lead Engineer