> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-5-pesky-elf-forum.md).

# \[Day 5] Pesky Elf Forum

{Web Exploitation = XSS}

## Story

The Elf Forum is where all the elves express their joy and excitement about Christmas, but Grinch Enterprises has one bad admin account, and they've installed a plugin that changes all mentions of Christmas to Buttmas!! McSkidy needs to find that admin account and disable the plugin.

## Challenge

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FQPLNg0gWOxSaym8HnfQb%2Fimage.png?alt=media\&token=6748c0db-07bc-4481-878e-582fb48e4e0c)

Logging in with the given credentials returns the following.

```
Username: McSkidy

Password: password
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FE5TV4XXT23zTPAYtjZEu%2Fimage.png?alt=media\&token=b6bbadf5-0c69-46c3-97e9-ebd89d61dc69)

Visiting the settings page reveals a password reset feature.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fir64o91qaSntny7JdADC%2Fimage.png?alt=media\&token=f645daf0-f9a4-4cad-8350-4b3b285b668e)

Posting the following as a comment reveals that the platform is vulnerable to stored XSS attacks. and any payload posted as a comment will run when another user accesses the page. 

```
<script>alert(1)</script>
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJrXTRmJxNRyu9njrKl98%2Fimage.png?alt=media\&token=6c7ac5b3-c4e5-4c07-9485-898e4f970aa8)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F5nabpv1kxIOmjdWGjNVv%2Fimage.png?alt=media\&token=9aaf28bf-fcf0-4da3-969d-386013209035)

Now I needed to chain this stored XSS with a password reset attack against the `grinch` account and I should be able to get in. The password reset is revealed when trying to change the password

```
http://10.10.31.34/settings?new_password=nee
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FRooFkRbC1KnQMNkh4DDF%2Fimage.png?alt=media\&token=b7ebb241-4066-494f-8ec9-0f950f54bab5)

Next, I posted a comment with the following contents to change the password of any visitor that visits that thread to `neewashere`

```
<script>fetch('/settings?new_password=neewashere');</script>
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F91wREe5wz4y7vBNK2xMb%2Fimage.png?alt=media\&token=a86dd8d3-e798-4985-81ce-c689fabc2442)

After waiting for about a minute or so, I was able to login to the `grinch` account with `neewashere` as the password. I was also able to see the active plugin and disable it.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FIpqxFBPqvti4OHkloytp%2Fimage.png?alt=media\&token=1afa06a2-74ff-46b3-8ea0-4519cd7baf7f)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FmZ53iEntU7PGscT9YHIY%2Fimage.png?alt=media\&token=0c3475ed-8a98-46f5-962f-7b0694733c11)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F689iTD3EbcLAWd4KaBqW%2Fimage.png?alt=media\&token=9ea88bc5-368e-40ab-8e38-e779123c0777)

{% hint style="success" %}
What flag did you get when you disabled the plugin?

* THM{NO\_MO\*\***\_**\*\*\*\*\*}
  {% endhint %}