🐀🐀🐀
0 pts earned
API Fetch
Premium Machine (Locked)
🧩 ExposedAPI
🖧 AD Network — ExposedAPI
API Users
🔒 API Profile
🔒 API Auth
🔒 API Admin
API Fetch
POST /api/v1/fetch makes outbound HTTP requests with user-supplied URLs. SSRF against localhost:8080/internal/dump returns an SSH private key. SUID /usr/bin/curl can read local files via file://.
🩸 First user blood: thinkverse
🩸 First root blood: thinkverse
Part of the ExposedAPI set — it is not listed on the main challenges page, but its ports are open to you. Connect straight to the target IP and ports below; no pivot needed.
Target IP
Premium required
User Flag
Pending
Root Flag
Pending
