Improve Repl Identity

[CodingCactus]

I’m always happy to get bothered for valid reasons like this!

[CodingCactus]

(to anyone looking at that typing repl to confirm the results, I have deleted the 249wpm fake runs but they did work)

[mattiselin]

Just to make sure I understand, the steps to repro this are:

1. Run someone’s console program that uses Repl Identity
2. While it’s running, hit CTRL-C to terminate the program
3. Now that you’re at the terminal, you can run arbitrary code. In this case, you’re running a program that calls the API, authenticating using Repl Identity. That allows you to authenticate as the user in the identity but control the payloads being sent.

Is that correct?

[bigminiboss]

yes, this is correct

[InvisibleOne]

@mattiselin Yes you just have to stop the repl and then run something like

subprocess.check_output([os.environ["REPLIT_CLI"], "identity", "create", "-audience=<their repl id>"]).decode('utf-8').strip()

and copy the token it outputs. For python at least, I haven’t tried with other languages but you can probably just run the identity command directly.

Once you have their identity token you can make requests to their API with the token and the API will believe it’s coming from a certain repl, letting you change whatever data the API will let you.

[bigminiboss]

I’ve tested this, and while I can generate a token, I, for some reason, cannot use the token from another repl. Pherhaps it’s because of anti-forwarding using CORS origin or something, I am not sure, but I remember noticing that they mentioned there are anti-forwarding measures

[InvisibleOne]

Are you making sure to decode and strip the token? It lets me use it from another repl

[bigminiboss]

mmm, I use the function I have, I don’t know for sure XD

[InvisibleOne]

My Example:

Client: https://replit.com/@InvisibleOne/Token-Hack-Example-Client#main.py
Server: https://replit.com/@InvisibleOne/Token-Hack-Example-Server#main.py
“Hack”: https://replit.com/@InvisibleOne/LiveUncomfortableProperty#main.py

I can confirm that from an alt account, I can run the code to generate an Identity token, then paste that token into my “hack” script and my API doesn’t know the difference.

[bigminiboss]

@bigminiboss

def create_identity_token(audience: str, cmd: str = "replit") -> str:
     """Create an identity token addressed to the given audience."""
     token = subprocess.check_output([cmd, "identity", "create", f"-audience={audience}"])
     return token.decode("utf-8").strip()

I used this code to test

[InvisibleOne]

That should output the token correctly. I’m not sure why you can’t use that token in another repl.

[bigminiboss]

oh ok, I did output it , just wrongly I guess

[InvisibleOne]

Yeah by default it will print out with a \n attached to it, you have to remove that for it to be valid

[bigminiboss]

oh dang it lol XD, man I gotta watch out for that

[bigminiboss]

Hey Invis, I ended up finding what was wrong: I submitted the wrong data (that is to say, I submitted it in the incorrect format xx.xxaccuracy instead of 0.xxxx accuracy)

[sonicx180]

lmho (laughing my hat off idont cuss) nice job for hacking bigminiboss

[bigminiboss]

thanks, yeah… trying tog et them to fix, don’t know if it’s still working. I can check

[bigminiboss]

would appreciate a vote XD

[sonicx180]

oh, I forgot about that :D.

[bigminiboss]

@CodingCactus @InvisibleOne @sonicx180 It works now!