The Sticker Shop
Can you exploit the sticker shop in order to capture the flag?
Recon
We begin with an Nmap scan and discover two open ports: port 22, which hosts an SSH service, and port 8080, running a Python Werkzeug server featuring a cat sticker shop.
The index page showcases various stickers, and there is also a Feedback page available.
The Feedback page allows users to submit comments, which are later reviewed by the staff. This suggests a potential entry point for an XSS attack.
Exploit
The challenge requires us to retrieve the flag from http://stickershop/flag.txt using client-side exploitation.
Additionally, it mentions that everything is developed and hosted on the same machine, which could be useful for our attack strategy.
Your local sticker shop has finally developed its own webpage. They do not have too much experience regarding web development, so they decided to develop and host everything on the same computer that they use for browsing the internet and looking at customer feedback. Smart move!
Can you read the flag at
http://stickershop:8080/flag.txt?
However, we are not allowed to access http://stickershop:8080/flag.txt.
First, we test for basic XSS by injecting a script that sends a request to our web server. If we receive a response, we can confirm the vulnerability.
Since we received a response, we can now craft a payload that forces the user's browser to make a request to the target page on our behalf.
Now, we craft a JavaScript payload that will fetch the content of the root path (/) and exfiltrate the Base64-encoded response to our remote server. The payload uses no-cors mode to bypass restrictions and credentials: 'same-origin' to include session cookies, allowing us to capture potentially sensitive data.
We get a base64-encoded response back.
We successfully got the index page by the user reviewing the feedback.
We modify our JavaScript payload to specifically fetch the contents of /flag.txt instead of the root path. The updated script ensures that the request captures the flag file and exfiltrates it to our remote server using Base64 encoding.
After we have submitted our payload, we get a connection back to our web server.
And it is the flag.
Last updated
Was this helpful?