starting to pwnshopize and rename things

web-security/cmdi-ls-filter/server

@@ -6,7 +6,8 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
 def challenge():
     directory = (
         flask.request.args.get("directory", "/challenge")
@@ -23,11 +24,11 @@ def challenge():
     command = f"ls -l {directory}"
     print(f"DEBUG: {command=}")
     listing = subprocess.run(
-        command,                    # the command to run
-        shell=True,                 # use the shell to run this command
-        stdout=subprocess.PIPE,     # capture the standard output
-        stderr=subprocess.STDOUT,   # 2>&1
-        encoding="latin"            # capture the resulting output as text
+        command,  # the command to run
+        shell=True,  # use the shell to run this command
+        stdout=subprocess.PIPE,  # capture the standard output
+        stderr=subprocess.STDOUT,  # 2>&1
+        encoding="latin",  # capture the resulting output as text
     ).stdout
 
     return f"""
@@ -40,8 +41,9 @@ def challenge():
         </body></html>
         """
 
+
 os.setuid(os.geteuid())
 os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/cmdi-ls-pipe/server

@@ -6,17 +6,18 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
 def challenge():
     directory = flask.request.args.get("directory", "/challenge").replace(";", "")
     command = f"ls -l {directory}"
     print(f"DEBUG: {command=}")
     listing = subprocess.run(
-        command,                    # the command to run
-        shell=True,                 # use the shell to run this command
-        stdout=subprocess.PIPE,     # capture the standard output
-        stderr=subprocess.STDOUT,   # 2>&1
-        encoding="latin"            # capture the resulting output as text
+        command,  # the command to run
+        shell=True,  # use the shell to run this command
+        stdout=subprocess.PIPE,  # capture the standard output
+        stderr=subprocess.STDOUT,  # 2>&1
+        encoding="latin",  # capture the resulting output as text
     ).stdout
 
     return f"""
@@ -29,8 +30,9 @@ def challenge():
         </body></html>
         """
 
+
 os.setuid(os.geteuid())
 os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/cmdi-ls-quote/server

@@ -6,17 +6,18 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
 def challenge():
     directory = flask.request.args.get("directory", "/challenge")
     command = f"ls -l '{directory}'"
     print(f"DEBUG: {command=}")
     listing = subprocess.run(
-        command,                    # the command to run
-        shell=True,                 # use the shell to run this command
-        stdout=subprocess.PIPE,     # capture the standard output
-        stderr=subprocess.STDOUT,   # 2>&1
-        encoding="latin"            # capture the resulting output as text
+        command,  # the command to run
+        shell=True,  # use the shell to run this command
+        stdout=subprocess.PIPE,  # capture the standard output
+        stderr=subprocess.STDOUT,  # 2>&1
+        encoding="latin",  # capture the resulting output as text
     ).stdout
 
     return f"""
@@ -29,8 +30,9 @@ def challenge():
         </body></html>
         """
 
+
 os.setuid(os.geteuid())
 os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/cmdi-ls-semicolon/server

@@ -6,17 +6,18 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
 def challenge():
     directory = flask.request.args.get("directory", "/challenge")
     command = f"ls -l {directory}"
     print(f"DEBUG: {command=}")
     listing = subprocess.run(
-        command,                    # the command to run
-        shell=True,                 # use the shell to run this command
-        stdout=subprocess.PIPE,     # capture the standard output
-        stderr=subprocess.STDOUT,   # 2>&1
-        encoding="latin"            # capture the resulting output as text
+        command,  # the command to run
+        shell=True,  # use the shell to run this command
+        stdout=subprocess.PIPE,  # capture the standard output
+        stderr=subprocess.STDOUT,  # 2>&1
+        encoding="latin",  # capture the resulting output as text
     ).stdout
 
     return f"""
@@ -29,8 +30,9 @@ def challenge():
         </body></html>
         """
 
+
 os.setuid(os.geteuid())
 os.environ["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/module.yml

@@ -1,6 +1,8 @@
 name: Web Security
 challenges:
-- id: level-1
+- id: path-traversal-1
+  transfer:
+    challenge: level-1
   name: Path Traversal 1
 - id: path-traversal-2
   name: Path Traversal 2
@@ -10,13 +12,17 @@ challenges:
   name: CMDi 2
 - id: cmdi-ls-quote
   name: CMDi 3
-- id: level-2
+- id: cmdi-env
+  transfer:
+    challenge: level-2
   name: CMDi 4
 - id: cmdi-touch-blind
   name: CMDi 5
 - id: cmdi-ls-filter
   name: CMDi 6
-- id: level-3
+- id: auth-bypass-param
+  transfer:
+    challenge: level-3
   name: Authentication Bypass 1
 - id: auth-bypass-cookie
   name: Authentication Bypass 2

web-security/level-1/server → web-security/path-traversal-1/server

@@ -5,12 +5,12 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
-@app.route("/<path:path>", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
+@app.route("/<path:path>", methods=["GET"])
 def challenge(path="index.html"):
     requested_path = app.root_path + "/files/" + path
     print(f"DEBUG: {requested_path=}")
-
     try:
         return open(requested_path).read()
     except PermissionError:
@@ -20,6 +20,7 @@ def challenge(path="index.html"):
     except Exception as e:
         flask.abort(500, requested_path + ":" + str(e))
 
+
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/path-traversal-2/server

@@ -5,12 +5,12 @@ import os
 
 app = flask.Flask(__name__)
 
-@app.route("/", methods=["GET", "POST"])
-@app.route("/<path:path>", methods=["GET", "POST"])
+
+@app.route("/", methods=["GET"])
+@app.route("/<path:path>", methods=["GET"])
 def challenge(path="index.html"):
     requested_path = app.root_path + "/files/" + path.strip("/.")
     print(f"DEBUG: {requested_path=}")
-
     try:
         return open(requested_path).read()
     except PermissionError:
@@ -20,6 +20,7 @@ def challenge(path="index.html"):
     except Exception as e:
         flask.abort(500, requested_path + ":" + str(e))
 
+
 app.secret_key = os.urandom(8)
-app.config['SERVER_NAME'] = f"challenge.localhost:80"
+app.config["SERVER_NAME"] = f"challenge.localhost:80"
 app.run("challenge.localhost", 80)

web-security/pwnshop.yml

@@ -0,0 +1,23 @@
+walkthrough: true
+binary_name_prefix: web-security
+build_image: pwncollege/challenge-legacy:latest
+verify_image: pwncollege/challenge-legacy:latest
+challenges:
+- id: path-traversal-1
+  challenge: PathTraversal
+  binary_name: server
+- id: path-traversal-2
+  challenge: PathTraversalStripped
+  binary_name: server
+- id: cmdi-ls-semicolon
+  challenge: CommandInjectionLS
+  binary_name: server
+- id: cmdi-ls-pipe
+  challenge: CommandInjectionLSPipe
+  binary_name: server
+- id: cmdi-ls-quote
+  challenge: CommandInjectionLSQuote
+  binary_name: server
+- id: cmdi-ls-filter
+  challenge: CommandInjectionLSFilter
+  binary_name: server