webProhard

The Block City Times

umasscybersec

Task: a token-gated news site chained a Flask launcher, a Spring Boot app, admin bots, file upload, and Actuator exposure. Solution: upload HTML as text/plain for stored XSS, switch the app into dev mode, abuse the report runner, and exfiltrate the FLAG cookie through article tags.

flask file_upload stored_xss admin_bot spring_boot actuator path_normalization

stored_xss_via_content_type_confusionactuator_env_overrideconfig_refresh_abusepath_normalization_bypassbot_cookie_exfiltration

$ ls tags/ techniques/

flask file_upload stored_xss admin_bot spring_boot actuator path_normalization

stored_xss_via_content_type_confusionactuator_env_overrideconfig_refresh_abusepath_normalization_bypassbot_cookie_exfiltration

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups