Entry 001
SSRF to RCE on Sau, and why the forgery worked
How an unauthenticated request-basket service reaches an internal Maltrail instance, and why the loopback restriction never applied to it at all.
Enumeration
The box exposes a single high port once the firewall is accounted for, which is the first thing worth noticing: the interesting service is the one that is not reachable from outside.
The forgery
A request basket will forward a request anywhere you tell it to. The mistake is not that it forwards — that is the product — but that the forwarding target is trusted the same way a loopback caller would be.
Why it worked
The restriction was applied at the wrong layer. Filtering the inbound origin says nothing about where an outbound request is allowed to land.