💾 Archived View for dioskouroi.xyz › thread › 29432767 captured on 2021-12-04 at 18:04:22. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

Challenge: can you view my source?

Author: colewilson

Score: 47

Comments: 30

Date: 2021-12-03 17:43:00

Web Link

________________________________________________________________________________

jim_dtrsec wrote at 2021-12-03 23:01:29:

I cheated and used REnigma to make a recording of chrome.exe running the alert in a VM. Then I found an execution point where the alert was on screen, made a memory dump, and ran the strings analysis the chrome.exe parent process (which acts as a sandbox for the rendering processes and handles all system interactions). That gave me the all of the virtual addresses where that string existed (there were several copies). I then hooked up GDB to remotely debug the replay at that execution point and dumped the strings near that address to extract the complete file.

0x25ca4b13381: "\t/_<202e>_/if(!window._enabled){window._enabled=true;document.querySelector(\"button\").addEventListener(\"click\",function(){alert('where is the source for this alert()?');});};/_<202e>_/;function isTouchDevic"...

(gdb)

0x25ca4b13449: "e(){return true;/_<202e>_/;return(('ontouchstart'in window)||(navigator.maxTouchPoints>0)||(navigator.msMaxTouchPoints>0));};/_<202e>_/;if(!isTouchDevice()){setTimeout(function(){setInterval(function(){if(g"...

(gdb)

0x25ca4b13511: "etComputedStyle(document.documentElement).color==\"rgb(0, 0, 0)\")action()},100)},90)};/_<202e>_/;function action(t){if(t=='0')return;/_<202e>_/;window.history.pushState(\".\",\"/haha\",\"/haha\");location=\"/haha\";"...

(gdb)

0x25ca4b135d9: "};/_<202e>_/;function addScript(){var my_awesome_script=document.createElement('script');my_awesome_script.setAttribute('src','main.js?i=d9c89773dd');document.body.appendChild(my_awesome_script);};/_<202e>_"...

(gdb)

0x25ca4b136a1: "/;async function _noscript(key){setInterval(addScript,1000);console.log(\"%c\"+key,\"background-image:url(/ping?type=img&key=\"+key+\")\");setInterval(function(){fetch(\"/get?key=\"+key).then((r)=>r.text()).t"...

(gdb)

0x25ca4b13769: "hen((t)=>action(t))},1000)};/_<202e>_/;_noscript(`8JWFZ`);\n//# sourceMappingURL=/ping?type=src&key=8JWFZ\n//\a\033[2Jnothing to see here!\257\244\\\002"

sandreas wrote at 2021-12-04 07:14:59:

May work, but there is a way easier strat... would you mind removing at least the sourcecode from your answer to keep the challenge more interesting?

sandreas wrote at 2021-12-03 21:59:20:

I really appreciate to not see the full solutions in the comments :-) Was a very nice puzzle and I would appreciate an article by the author on how it is exactly done and how he came up with the idea...

Thanks man.

karmakaze wrote at 2021-12-03 19:56:07:

My user agent can execute it, so I presume if I were to make the same requests in the same order with the same params, I'd be able to see it. I don't care to actually do it though, only to know that it could be done if there was actual motivation.

colewilson wrote at 2021-12-03 19:58:41:

Perhaps! There are also some tricks built in to stop you from curling it, as it will send some escape characters to your terminal that clear the screen.

jazzyjackson wrote at 2021-12-03 20:08:20:

I was able to capture main.js by using firefox inspector and throttling the connection to GPRS, and hitting the STOP before anything else happened. I'm surprised the escape characters prevented me from curling to a file tho.

arkokoley wrote at 2021-12-03 23:27:20:

Yep.. throttling the connection worked for me too!

c0wb0yc0d3r wrote at 2021-12-03 20:04:04:

Is the page borked? It will let me view the page for a bit, and then I'm redirected to /haha. (I didn't try to inspect an element.)

colewilson wrote at 2021-12-03 20:07:26:

it does have some false positives, like when your mouse leaves the page. Sorry about that!

karmakaze wrote at 2021-12-03 20:16:41:

I would have used a proxy.

Nextgrid wrote at 2021-12-03 20:02:07:

That assumes it can detect you're curling it in the first place.

jazzyjackson wrote at 2021-12-03 20:12:50:

the escape characters are embedded as comments in the source code whether or not you curl it

robgibbons wrote at 2021-12-04 03:28:54:

Cole added a v2 after a few dozen folks solved the first version. v2 was a bit trickier, but took me about the same amount of time since I didn't have to solve it all from scratch, just the weird new bits. Looking forward to v3!

Asraelite wrote at 2021-12-04 11:52:09:

The sourcemap trick is really nice, I wouldn't have thought of that.

remram wrote at 2021-12-04 05:00:47:

It's easy enough to dump the responses as HAR and run the little bit of of char code manipulation at the bottom (replace eval() with document.write() to see it). The button doesn't work in Firefox though, so I wasn't too surprised to get incomplete source code out too.

emurlin wrote at 2021-12-04 00:52:34:

Got it (although it doesn't seem to work on MSIE), which I guess is fine. However, it reminded me of

https://www.sitepoint.com/community/t/i-found-a-way-to-hide-...

_Microft wrote at 2021-12-03 18:13:51:

The button doesn't do anything in Firefox or Edge by the way.

colewilson wrote at 2021-12-03 18:39:05:

Sorry about that! The server I have it running on is getting to any requests and doesn't seem to be loading the script correctly

EDIT: it's all fixed now!

dalmo3 wrote at 2021-12-03 20:07:09:

Just reading the page is challenge in itself. It seems to timeout after 5 seconds and redirects to /haha. (Chrome/Android)

colewilson wrote at 2021-12-03 20:11:28:

Sorry about that! It doesn't work on touch devices very well right now because it relies on mouse movements. However, I just fixed it.

dalmo3 wrote at 2021-12-03 20:15:50:

No worries. Can confirm it's fixed, thanks!

garaetjjte wrote at 2021-12-04 02:53:32:

Seems easy enough, I just opened devtools, enabled breakpoint on XHR and refreshed page, it drops straight into debugger with full code.

colewilson wrote at 2021-12-04 03:07:04:

Can you actually see the alert() function though? There is a little bit of decoding that must be done even after the source is viewed.

garaetjjte wrote at 2021-12-04 16:13:26:

Yes.

https://i.imgur.com/YMn1t8L.png

ryankrage77 wrote at 2021-12-03 21:42:00:

I couldn't get it in the web inspector or with mitmproxy :(

robgibbons wrote at 2021-12-03 23:14:37:

I'll give you a hint: the page knows when you have DevTools open. Now, how could it do that?

mikewarot wrote at 2021-12-03 21:37:16:

If my computer can get it, I can get it. It's a matter of ownership.

wget worked for me

christophetd wrote at 2021-12-03 23:20:28:

Seems it works only in Chrome (not Firefox). Nice one, though.

joeframbach wrote at 2021-12-03 20:29:57:

Charles Proxy captures the traffic just fine.

NikolaeVarius wrote at 2021-12-03 20:31:24:

Got it, took me a sec