The Great XSS challenge @ Belluminar 2018

Just a simple reversing + web challenge

Transcript

1. The Great XSS Challenge jinmo123 @ CyKor
3. Challenge description Add following host entry for SSL. The server does, too. 192.168.1.73 0e1.kr Submit your URL to http://0e1.kr:8080 to get flag on https://0e1.kr:8000/flag. h2proxy: HTTP/2.0 <-> HTTP/1.1 proxy running on 8000. I wrote it.
4. Server architecture • Attacker submit a link --> chrome launches, visits the link • Flag is on https://0e1.kr:8000 http://0e1.kr:8080 puppeteer (Latest chrome)
5. Server architecture (cont.) • Flag is on 0e1.kr:8000/flag (HTTP/2), only gives flag to 127.0.0.1 • 0e1.kr:8000 (HTTP/2) <- h2proxy -> localhost:8888 (HTTP/1.1) h2 https://0e1.kr:8000 (flag storage) localhost:8888 (express.js)
6. Challenge description (cont.) • :8000 (h2proxy) • :8080 (static page + bot), :8888 (express.js) • All source code is given except flag in secrets.js • Throw a link to :8080, and get :8000/flag! • (or :8888, which is impossible)
7. :8888 a.k.a 8000 / /echo/.. • No reflective XSS, but /echo/ handler: app.get('/echo/:param', (req, res) => { // X-Frame-Options, No XSS auditor res.header('x-echo', req.params.param); res.end(JSON.stringify({"echo": req.params.param})); }) (Obviously no XSS here)
8. :8888 a.k.a 8000 / /flag • Not from 127.0.0.1: • From 127.0.0.1:
9. :8888 a.k.a 8000 / h2proxy • handmade HTTP/2 proxy implementation • Has bug
10. Learning HTTP/2 via h2proxy
11. Learning HTTP/2 via h2proxy HPACK Compression
12. h2proxy bug / off-by-one on HPACK encoder • HTTP/1.1 -> HTTP/2 side max_number = (1 << prefix_bits) must be max_number = (1 << prefix_bits) - 1
13. Discovery • I made this bug unintentionally, but the exploitation was fun • Make server to give a large header, then…
14. Bug • If a header(e.g. X-echo)’s length is 0x80, it must be 0x7F 0x01 • But the server encodes 0x80 • X-echo’s length becomes 0 with Huffman encoding (0x80)
15. Bug (cont.) • You can insert arbitrary header after X-echo • It’s achievable by using ASCII codes within 0x20 <= c <= 0x7F
16. Exploitation • Header encoding • 0x80: Known key & value – (0x80 + index) (e.g. method: GET) • 0x40: Known key – (0x40 + index | (length) | value) • 0x00: Unknown key & value – ((length) | key | (length) | value)
17. Exploitation • “Known headers” • (RFC 7541: Header Compression for HTTP/2) • e.g. Let’s use Content-Type header! • 0x40 + 0x1F = 0x5F
18. Exploitation • text/html !
19. Exploitation
21. !!!
22. Remaining steps • Upload a HTML to your server that sets name • it’s passed to eval(name) • Get /flag and send to your server by using XHR
23. Demo
24. Summary • There’s vulnerability in h2proxy, which is just a HPACK • Use Content-Type to make echo-backed content a HTML document • Get /flag! h2 https://0e1.kr:8000 (flag storage) localhost:8888 (express.js)
25. Q&A