[quote=meowmeowattack]
[quote=xGarfield]
[quote=meowmeowattack]
[quote=hacker9999]
tried generate payload from CVE-2020-8165 and universal deserialisation gadget from
https://devcraft.io/2021/01/07/universal-deserialisation-gadget-for-ruby-2-x-3-x.html
And replace username value with payload when register
but no luck
[/quote]
same here, i also tried sending the payload canonically and via the url params instead of a post body.
authenticity_token=<token>&user[username]=Marshal.load&user[username]=Base64.decode64&user[username]=<payload>&user[password]=test&user[password_confirmation]=test
from the cookie settings, i'm more convinced the first step is not about xss, as it's httponly.
from the redirects of login/register, i can see it's redirected to derailed.htb:3003, which is weird, but couldn't map it to any vectors for now
from browsing the clipnotes, i can see there is a user called alice who posted clipnotes/1, bruteforcing password didn't succeed
some hints would be appreciated
[/quote]
you are going down a rabbit hole. the app has two roles [admin and user]. what if you could register a user with a admin "role" 😉
[/quote]
ye, that's what i tried at first, but didn't figure out the correct term/wording. anyway, that's the unintended way and has been patched now.
given the unintended way patched and cookie is httponly, i feel the next possible vector would be csrf to change some state for the user we created and then proceed.
[/quote]
That's how the reports look like when they are downloaded
4,bl
4,bl
4,bl
57,pls
Maybe there's some script parsing those records and opening them using a headless browser or something. Changelog of the machine could hint to a headless browser
