stypr

TL;DR

Exploiting a react app by customElement and is=is pollution

Solution

There is a bug with the hydration, so we can pollute prop of the <img> tag.
Error message is triggered when the window.width < 600. Interestingly, location.hash fills the props upon displaying the error message.
When the error message is shown and you try to resize your window.width > 600, <img> is shown again.
Since there is a dehydration bug, prop gets filled with the existing location.hash, making it possible to add additional attributes on the `` tag.

https://flattsecurity.medium.com/finding-an-unseen-sql-injection-by-bypassing-escape-functions-in-mysqljs-mysql-90b27f6542b4

web: guestbook writeup

Checking configs/worker

docker-compose.yml

Docker-compose is build in a way that

private has flag in /flag
redis / worker are used. this is only used for admin to check the challenge.

web: simpleboard writeup

Let's check the main page's source code by view-source (view-source:http://web1.bingo.hypwnlab.com:12044/)

As wee see in the following, server loads an image from a website.

        <h3 class="text-center text-white pt-5"><img src="/?image=6c6f676f.png"></h3>

Let's take a look at the function in init.php that loads the image.

web: temporary writeup

There are two instances namely public and internal. We can get the address of public by leaking $_SERVER['REMOTE_ADDR"] in phpinfo.php?phpinfo

$_SERVER['SERVER_NAME']	_
$_SERVER['SERVER_PORT']	80
$_SERVER['SERVER_ADDR']	172.21.0.2

	import os
	import time
	import uuid
	import requests
	requests.packages.urllib3.disable_warnings()

	headers = {
	"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0",
	"Accept": "application/json, text/plain, /",
	"Accept-Language": "en-US,en;q=0.5",

	#!/usr/bin/python3 -u
	# make sure to set crontab
	# 0 0 * * * python3 /root/cf.py

	import sys
	import logging
	from collections import Counter
	import requests
	import cloudflare

	# /etc/systemd/system/configure-ipv6.service

	[Unit]
	Description=Configure IPv6 address and Add IPv6 Default Route via Script
	After=network-online.target
	Wants=network-online.target

	[Service]
	Type=oneshot
	ExecStart=/usr/local/bin/configure_ipv6.sh

	'use strict'

	/**
	* MailDev - routes.js
	*/
	const express = require('express')
	const compression = require('compression')
	const pkg = require('../package.json')
	const { filterEmails } = require('./utils')

	// run before send
	const originalSend = WebSocket.prototype.send;
	window.sockets = [];
	WebSocket.prototype.send = function(...args) {
	if (window.sockets.indexOf(this) === -1)
	window.sockets.push(this);
	return originalSend.call(this, ...args);
	};

	// run after send