webProhard

The Block City Times V2

umasscybersec

Task: a token-gated news site exposed a Flask launcher, Spring Boot app, editorial bot, and report-runner bot. Solution: reuse the upload-to-stored-XSS bug, switch the app into dev mode through Actuator, then reflect a duplicate-tag exception at /api/tags to execute JavaScript in the FLAG-bearing browser.

flask file_upload stored_xss admin_bot spring_boot actuator error_reflection

stored_xss_via_content_type_confusionactuator_env_overrideconfig_refresh_abusebot_cookie_exfiltrationduplicate_element_exception_reflection

$ ls tags/ techniques/

flask file_upload stored_xss admin_bot spring_boot actuator error_reflection

stored_xss_via_content_type_confusionactuator_env_overrideconfig_refresh_abusebot_cookie_exfiltrationduplicate_element_exception_reflection

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups