TryHackMe MD2PDF Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the MD2PDF machine on TryHackMe. This machine highlights the impact of Local File Inclusion vulnerabilities. Let’s get into it. 🍾 🙌 🎉

description:

Hello Hacker! TopTierConversions LTD is proud to announce its latest and greatest product launch: MD2PDF. This easy-to-use utility converts markdown files to PDF and is totally secure! Right…? Note: Please allow 3–5 minutes for the VM to boot up fully before attempting the challenge.

We start with Threader3000 to discover open ports, then confirm services with Nmap. Port 5000 is open alongside the standard ports.

Directory scanning port 80 reveals an /admin endpoint.

Navigating to /admin leaks the internal path of the endpoint.

Port 5000 shows us an interface that appears to accept input but doesn’t do anything visibly. Further directory scanning on port 5000 reveals the same structure as port 80.

Back on port 80, we see a markdown editor that converts input to a downloadable PDF. We send a test payload to understand the conversion flow.

The test data appears correctly in the generated PDF.

We download the PDF and inspect it with exiftool. The Creator field reveals wkhtmltopdf 0.12.5, a version known to be vulnerable to LFI.

We find this reference explaining the LFI in detail.

We test by pointing the iframe source at port 5000 to understand the redirect behavior.

1<iframe src="http://localhost:5000/"></iframe>

The content from localhost:5000 is rendered in the PDF. The vulnerability is exploitable. 🥳

Now we point the iframe at the internal /admin path we discovered earlier.

1<iframe src="http://localhost:5000/admin"></iframe>

The flag is right there in the generated PDF.

Thanks for reading, happy hacking! :)