# CVE-2018-16794 on fs.thefacebook.com

ADFS login on fs.thefacebook.com resolved attacker-controlled DOMAIN via SRV lookup, leaking internal DnsHostName and corporate IP through a Netlogon SSRF.

- Payout: $1,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2019-03-11
- CVE: CVE-2018-16794
- Write-up quality: 6/10
- Original: https://philippeharewood.com/cve-2018-16794-on-fs-thefacebook-com/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-cve-2018-16794-on-fs-thefacebook-com
- Tags: domain:web impact:internal-access kind:bounty platform:blog sev:medium tech:windows technique:oob-exfil technique:recon vuln:info-disclosure vuln:ssrf

**Target:** ADFS login endpoint (fs.thefacebook.com) DOMAIN\User field
**Root cause:** The ADFS login flow performs a DNS SRV lookup (_ldap._tcp.pdc._msdcs.<DOMAIN>) on the user-supplied DOMAIN and then connects to the returned host on port 389, letting an attacker point it at their own server.
**Steps:**
1. Register a domain and add SRV record `_ldap._tcp.pdc._msdcs.<domain>` pointing to attacker host port 389.
2. Run a listener on port 389 (scapy dns_listener.py) on the attacker host.
3. Submit login to fs.thefacebook.com with username `<attackerdomain>\example123` and any password.
4. Observe inbound connection on port 389 and capture the Netlogon response containing DnsHostName and corporate IP.
**How found:** Started from CVE-2018-16794 (SSRF via txtBoxEmail in Microsoft ADFS) and tested whether the DOMAIN\User login format on fs.thefacebook.com would trigger a controllable SRV lookup.
**Exploitation:** Attacker controls the DOMAIN portion of the login; the ADFS server resolves the attacker's SRV record and initiates an LDAP/Netlogon connection to the attacker's listener, which responds and receives a Netlogon reply leaking the internal DnsHostName and corporate IP.
**Insight:** Windows domain-join/login flows that accept DOMAIN\User will do SRV lookups on the attacker-supplied domain; hosting a fake PDC SRV record plus a port-389 listener turns the login form into an SSRF that leaks Netlogon metadata.