let's not be path-injectable

pwncollege · Sep 1, 2024 · 0f59bb1 · 0f59bb1
1 parent ab3d214
commit 0f59bb1
Show file tree

Hide file tree

Showing 6 changed files with 6 additions and 0 deletions.
diff --git a/web-security/cmdi-ls-filter/server b/web-security/cmdi-ls-filter/server
@@ -39,5 +39,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)
diff --git a/web-security/cmdi-ls-pipe/server b/web-security/cmdi-ls-pipe/server
@@ -28,5 +28,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)
diff --git a/web-security/cmdi-ls-quote/server b/web-security/cmdi-ls-quote/server
@@ -28,5 +28,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)
diff --git a/web-security/cmdi-ls-semicolon/server b/web-security/cmdi-ls-semicolon/server
@@ -28,5 +28,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)
diff --git a/web-security/cmdi-touch-blind/server b/web-security/cmdi-touch-blind/server
@@ -27,5 +27,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)
diff --git a/web-security/level-2/server b/web-security/level-2/server
@@ -28,5 +28,6 @@ def challenge():
         """
 
 os.setuid(os.geteuid())
+os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
 app.run("challenge.localhost", 8080 if os.geteuid() else 80)