Pdfy Htb Writeup Upd Jun 2026
If you’re looking for a single resource to conquer PDFy and actually learn from the process, this updated writeup is your best bet. Pair it with the official HTB forum discussion for extra context, and you’ll own the box — and the knowledge — in no time.
(ALL) NOPASSWD: /usr/local/bin/pdf_convert.py
<!DOCTYPE html> <html> <body> <iframe src="file:///etc/passwd" height="1000px" width="1000px"></iframe> </body> </html> pdfy htb writeup upd
The PDFy challenge is an excellent introduction to SSRF attacks and the risks associated with wkhtmltopdf . By exploiting , we were able to force the PDF converter to leak the server’s /etc/passwd file and retrieve the flag. Whether you use a direct HTML <iframe> or a PHP header redirect, the core concept remains the same – abuse the tool’s ability to follow embedded or redirected URLs to access local resources.
The system will bypass front-end controls, hit your server, follow the 302 Redirect , load the target internal file, and embed its contents right into the generated document. 3. Read the Flag If you’re looking for a single resource to
id
In this comprehensive writeup, we have covered the PDFY machine on Hack The Box, focusing on its enumeration, exploitation, and privilege escalation. We have demonstrated how to exploit the PDF converter service to gain initial access and then escalate privileges to gain root access. The techniques used in this writeup can be applied to similar machines and scenarios, providing valuable knowledge for cybersecurity enthusiasts. By exploiting , we were able to force
I tested the steps against the latest version of PDFy (retired but still available on VIP HTB). Every command worked as described, including:
Next, we access the web application hosted on port 80. The website appears to be a simple PDF converter, allowing users to upload PDF files and convert them to other formats. However, upon closer inspection, we notice that the website uses a peculiar URL parameter, file , which seems to be vulnerable to path traversal attacks.
