THM: MD2PDF

Web application with markdown to PDF conversion functionality vulnerable to SSRF. Embedded iframe pointing to localhost admin panel in markdown input, forcing server to request restricted resource and return it in generated PDF.

Initial Enumeration

Nmap Scan

nmap -sS -sV -sC TARGET_IP

Results:

• Port 80: HTTP
• Port 5000: HTTP (admin panel)

---

Vulnerability Discovery

Gobuster Enumeration

gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirb/common.txt

Discovery: /admin endpoint accessible only from localhost (SSRF indicator)

---

Exploitation

Understanding the Vulnerability

Web application on port 80 converts markdown to PDF and accepts user input.

The admin panel on port 5000 is restricted to localhost access only.

Attack Vector: Use SSRF via iframe to force server to request localhost admin page.

---

SSRF Payload

Crafting the Attack

<iframe src="http://localhost:5000/admin"></iframe>

Execution Flow

1. Submit iframe payload to markdown converter
2. Server processes markdown input
3. Server renders iframe (makes request to localhost:5000/admin)
4. Server converts result to PDF
5. PDF with admin page content returned to attacker

---

Flag Retrieval

Submit the payload through the web interface.

Result: Flag appears in generated PDF displayed in browser.

---

Notable Commands

Command	Description
nmap -sS -sV -sC	SYN scan with service and script detection
gobuster dir -u URL -w wordlist	Directory brute forcing
<iframe src="http://localhost:PORT/path">	SSRF payload via iframe

---

Key Takeaways

• File conversion services (PDF, image generation) are common SSRF targets
• Services restricted to localhost can be accessed via SSRF vulnerabilities
• Simple HTML tags like <iframe> force server-side requests
• Always test conversion services for SSRF by attempting internal resource access
• Localhost restrictions are bypassable when application processes user-controlled URLs

---

Room: MD2PDF

Platform: TryHackMe

Difficulty: Easy

Vulnerability: SSRF via PDF Conversion