마크다운 컨셉의 XSS 문제다.
코드를 보면 아래와 같다.
<head>
<meta charset="UTF-8">
<link rel="stylesheet" href="/static/style.css" />
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"></script>
</head>
<script>
input = decodeURIComponent(location.search.match(/input=([^&#]+)/)[1]);
function markdown(text){
text = text
.replace(/[<]/g, '')
.replace(/----/g,'<hr>')
.replace(/> ?([^\n]+)/g, '<blockquote>$1</blockquote>')
.replace(/\*\*([^*]+)\*\*/g, '<b>$1</b>')
.replace(/__([^_]+)__/g, '<b>$1</b>')
.replace(/\*([^\s][^*]+)\*/g, '<i>$1</i>')
.replace(/\* ([^*]+)/g, '<li>$1</li>')
.replace(/##### ([^#\n]+)/g, '<h5>$1</h5>')
.replace(/#### ([^#\n]+)/g, '<h4>$1</h4>')
.replace(/### ([^#\n]+)/g, '<h3>$1</h3>')
.replace(/## ([^#\n]+)/g, '<h2>$1</h2>')
.replace(/# ([^#\n]+)/g, '<h1>$1</h1>')
.replace(/(?<!\()(https?:\/\/[a-zA-Z0-9./?#-]+)/g, '<a href="$1">$1</a>')
.replace(/!\[([^\]]+)\]\((https?:\/\/[a-zA-Z0-9./?#]+)\)/g, '<img src="$2" alt="$1"/>')
.replace(/(?<!!)\[([^\]]+)\]\((https?:\/\/[a-zA-Z0-9./?#-]+)\)/g, '<a href="$2">$1</a>')
.replace(/`([^`]+)`/g, '<code>$1</code>')
.replace(/```([^`]+)```/g, '<code>$1</code>')
.replace(/\n/g, "<br>");
return text;
}
window.onload=function(){
$("#markdown").text(input);
$("#rendered").html(markdown(input));
}
</script>
<h1>Input:</h1><br>
<pre contenteditable id="markdown" class="background-grey"></pre><br>
<br>
<button onclick='$("#rendered").html(markdown($("#markdown").text()))'>Update preview</button>
<hr>
<br>
<h1>Preview:</h1><br>
<div id="rendered" class="rendered background-grey"></div>
'CTF > Writeup' 카테고리의 다른 글
| Midnight Sun CTF 2019 Quals Rubenscube (0) | 2019.04.08 |
|---|---|
| CBM CTF 2019 Writeup (0) | 2019.04.08 |
| Radar CTF 2019 Inj3c7 (0) | 2019.04.05 |
| Encrypt CTF 2019 Write up (0) | 2019.04.05 |
| Codegate 2019 Open CTF Reversing Write up (2) | 2019.04.02 |
JeonYoungSin
메모 기록용 공간