-
Notifications
You must be signed in to change notification settings - Fork 12
/
Copy pathwtjs.tar
193 lines (174 loc) · 20 KB
/
wtjs.tar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
wtjs/go.mod 0000644 0000000 0000000 00000000211 00000000000 007774 0 ustar module github.com/redpwn/redpwnctf-challs-2021/web/wtjs
go 1.16
require github.com/redpwn/rctf-golf v0.0.0-20210615031943-88d7bc43a6db
wtjs/Dockerfile 0000644 0000000 0000000 00000000412 00000000000 010663 0 ustar FROM golang:1.16.5 AS builder
WORKDIR /wtjs
COPY go.mod go.sum ./
RUN go mod download && go mod verify
COPY . .
RUN CGO_ENABLED=0 go build -v
FROM gcr.io/distroless/static:latest as run
COPY --from=builder /wtjs/wtjs .
ENV PORT=8080
EXPOSE 8080
CMD ["/wtjs"]
wtjs/go.sum 0000644 0000000 0000000 00000005240 00000000000 010030 0 ustar github.com/DATA-DOG/go-sqlmock v1.3.3/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
github.com/antonmedv/expr v1.8.9/go.mod h1:5qsM3oLGDND7sDmQGDXHkYfkjYMUX14qsgqmHhwGEk8=
github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg=
github.com/gdamore/tcell v1.3.0/go.mod h1:Hjvr+Ofd+gLglo7RYKxxnzCBmev3BzsS67MebKS4zMM=
github.com/lucasb-eyer/go-colorful v1.0.2/go.mod h1:0MS4r+7BZKSJ5mw4/S5MPN+qHFF1fYclkSPilDOKW0s=
github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
github.com/mattn/go-runewidth v0.0.8/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/redpwn/rctf-golf v0.0.0-20210615031943-88d7bc43a6db h1:zaljqar8RoBYEptTh5INIaWdf38ZoA7/Z7ZvJwz8MKU=
github.com/redpwn/rctf-golf v0.0.0-20210615031943-88d7bc43a6db/go.mod h1:zIuelQ/dTgWQg6jLWb9/Td2C9NwNzcNlVbQAjErcsRY=
github.com/rivo/tview v0.0.0-20200219210816-cd38d7432498/go.mod h1:6lkG1x+13OShEf0EaOCaTQYyB7d5nSbb181KtjlS+84=
github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
github.com/sanity-io/litter v1.2.0/go.mod h1:JF6pZUFgu2Q0sBZ+HSV35P8TVPI1TTzEwyu9FXAw2W4=
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
wtjs/main.go 0000644 0000000 0000000 00000007405 00000000000 010155 0 ustar package main
import (
"fmt"
"net/http"
"os"
"strconv"
"text/template"
rctfgolf "github.com/redpwn/rctf-golf"
)
type templateArgs struct {
Error string
Script string
Length int
}
const htmlTemplateStr = `<!DOCTYPE html>
<html>
<head>
<title>WTJS?!</title>
</head>
<body>
<h1>Welcome to WTJS!</h1>
<p>There's no real context to this challenge, it's just an exercise in JS golfing. Your input goes into a script tag, and your goal is to steal the admin's cookies!</p>
<p>You're only allowed to use the characters <code>()*+=>[]_</code> in your code.</p>
<p>Since this is a golf challenge, the number of characters you're allowed to use will slowly increase throughout the CTF. Currently, you are allowed {{ .Length }} characters.</p>
<p>Good luck!</p>
{{- with .Error }}
<div style="color: red;">
<h2>Error</h2>
{{ . }}
</div>
{{- end }}
<textarea id="payload"></textarea>
<div id="chars"></div>
<div id="info"></div>
<button id="submit">Create!</button>
<script>
// BEGIN USER SCRIPT
{{ .Script }}
// END USER SCRIPT
(() => {
const maxLen = {{ .Length }}
const charsTest = /^[\(\)\*\+=>\[\]_]*$/
const eTa = document.getElementById('payload')
const eChars = document.getElementById('chars')
const eInfo = document.getElementById('info')
const eSubmit = document.getElementById('submit')
const onTaUpdate = () => {
eTa.value = eTa.value.replace(/\n/g, '')
const len = eTa.value.length
eChars.innerText = len + '/' + maxLen
if (len > maxLen || !eTa.value.match(charsTest)) {
eChars.style.color = 'red'
eSubmit.disabled = true
} else {
eChars.style.color = null
eSubmit.disabled = false
}
}
onTaUpdate()
eTa.addEventListener('input', onTaUpdate)
eSubmit.addEventListener('click', e => {
e.preventDefault()
window.location.search = '?script=' + encodeURIComponent(eTa.value)
})
})()
</script>
</body>
</html>
`
func getLimit() (int, error) {
elapsed, err := rctfgolf.GetTime("https://2021.redpwn.net", "wtjs")
if err != nil {
return 0, err
}
return int(elapsed.Minutes()/5) + 100, nil
}
func main() {
port, err := strconv.Atoi(os.Getenv("PORT"))
if err != nil {
port = 8080
}
htmlTemplate, err := template.New("html").Parse(htmlTemplateStr)
if err != nil {
panic(err)
}
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
limit, err := getLimit()
if err != nil {
w.WriteHeader(500)
w.Write([]byte("Error computing limits, challenge (temporarily?) broken!"))
fmt.Fprintln(os.Stderr, err.Error())
return
}
r.ParseForm()
script := ""
if len(r.Form["script"]) > 0 {
script = r.Form["script"][0]
}
if len(script) > limit {
if err := htmlTemplate.Execute(w, templateArgs{Error: "Payload too long!", Length: limit}); err != nil {
w.Write([]byte("Internal Server Error"))
fmt.Fprintln(os.Stderr, err.Error())
return
}
return
}
for _, ch := range script {
if ch != '(' && ch != ')' && ch != '*' && ch != '+' && ch != '=' && ch != '>' && ch != '[' && ch != ']' && ch != '_' {
w.WriteHeader(http.StatusBadRequest)
if err := htmlTemplate.Execute(w, templateArgs{Error: fmt.Sprintf(`Illegal character: "%c"`, ch), Length: limit}); err != nil {
w.Write([]byte("Internal Server Error"))
fmt.Fprintln(os.Stderr, err.Error())
return
}
return
}
}
if err := htmlTemplate.Execute(w, templateArgs{Script: script, Length: limit}); err != nil {
w.Write([]byte("Internal Server Error"))
fmt.Fprintln(os.Stderr, err.Error())
return
}
})
http.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusNotFound)
})
fmt.Printf("Listening on port %d\n", port)
if err := http.ListenAndServe(fmt.Sprintf(":%d", port), nil); err != nil {
panic(err)
}
}