# SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE

Crafted SVG with UNC path made ImageMagick's librsvg fetch remote SMB share, leaking server NTLMv2 hash and credentials for offline cracking or SMB relay.

- Payout: $1,500
- Severity: high
- Program: Rockstar Games
- Credited: alexbirsan
- Disclosed: 2018-01-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/288353
- Library page: https://bugbountylibrary.com/r/h1%3A288353
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:php technique:oob-exfil vuln:secrets-leak vuln:ssrf

**Target:** SVG emblem editor image processing (ImageMagick/librsvg)
**Root cause:** ImageMagick/librsvg processing of user-submitted SVG allowed UNC paths (\\attacker\share), causing the server to authenticate to an attacker-controlled SMB listener and leak NTLMv2 credentials.
**Steps:**
1. Upload crafted SVG to emblem editor containing a reference to a UNC path like `\\attacker-host\share\file`
2. Server-side ImageMagick/librsvg resolves the UNC path and initiates SMB authentication to attacker host
3. Attacker runs SMB listener (e.g. Responder) capturing NTLMv2 hash and credentials
4. Crack hash offline or relay it to another service
**How found:** Researcher knew ImageMagick would fetch remote resources referenced in SVG; tested UNC paths to see if server would authenticate to an external SMB listener.
**Exploitation:** Attacker hosts an SMB listener, submits SVG referencing the UNC path; server authenticates outbound, leaking NTLMv2 hash for offline cracking or SMB relay to pivot toward RCE.
**Escalation:** NTLMv2 hash could be cracked or relayed to internal services, potentially leading to RCE.
**Insight:** When an app processes user-supplied images/SVG server-side, test UNC/network path references (\\host\share) to force outbound SMB auth and capture NTLM hashes—image libraries often resolve remote resources.