From 48ae01aa1d7fc1d94970e9fd69d4fa93fcc442f3 Mon Sep 17 00:00:00 2001 From: Yan Date: Tue, 10 Sep 2024 22:47:57 -0700 Subject: [PATCH] Revert "close the loophole" -- connor fixed it dojo-wide This reverts commit 6a634183647c8b43fa0010afd5866e90f9719f8c. --- web-security/csrf-reflected-alert/victim | 5 ----- web-security/level-10/victim | 5 ----- web-security/level-11/victim | 5 ----- web-security/level-12/victim | 5 ----- web-security/level-13/victim | 5 ----- web-security/level-14/victim | 5 ----- web-security/level-8/victim | 5 ----- web-security/level-9/victim | 5 ----- web-security/xss-exfil-cookie/victim | 5 ----- web-security/xss-rf-post/victim | 5 ----- web-security/xss-stored-alert/victim | 5 ----- 11 files changed, 55 deletions(-) diff --git a/web-security/csrf-reflected-alert/victim b/web-security/csrf-reflected-alert/victim index 322abf7..3d6107f 100755 --- a/web-security/csrf-reflected-alert/victim +++ b/web-security/csrf-reflected-alert/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-10/victim b/web-security/level-10/victim index 22b2753..ceb3f51 100755 --- a/web-security/level-10/victim +++ b/web-security/level-10/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-11/victim b/web-security/level-11/victim index ce4efe1..d196f92 100755 --- a/web-security/level-11/victim +++ b/web-security/level-11/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-12/victim b/web-security/level-12/victim index ce4efe1..d196f92 100755 --- a/web-security/level-12/victim +++ b/web-security/level-12/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-13/victim b/web-security/level-13/victim index e6ce749..f1092ae 100755 --- a/web-security/level-13/victim +++ b/web-security/level-13/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-14/victim b/web-security/level-14/victim index e6ce749..f1092ae 100755 --- a/web-security/level-14/victim +++ b/web-security/level-14/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/level-8/victim b/web-security/level-8/victim index 5e3d094..1863a48 100755 --- a/web-security/level-8/victim +++ b/web-security/level-8/victim @@ -39,11 +39,6 @@ if url_parsed.port == 8080: reward = "pwn.college{fake_flag}" elif url_parsed.port in {None, 80}: reward = open("/flag").read() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") else: print("Port should be 80 (real service) or 8080 (debug port).") sys.exit(3) diff --git a/web-security/level-9/victim b/web-security/level-9/victim index 5e3d094..1863a48 100755 --- a/web-security/level-9/victim +++ b/web-security/level-9/victim @@ -39,11 +39,6 @@ if url_parsed.port == 8080: reward = "pwn.college{fake_flag}" elif url_parsed.port in {None, 80}: reward = open("/flag").read() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") else: print("Port should be 80 (real service) or 8080 (debug port).") sys.exit(3) diff --git a/web-security/xss-exfil-cookie/victim b/web-security/xss-exfil-cookie/victim index 3ffc02b..7d391c3 100755 --- a/web-security/xss-exfil-cookie/victim +++ b/web-security/xss-exfil-cookie/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/xss-rf-post/victim b/web-security/xss-rf-post/victim index 22b2753..ceb3f51 100755 --- a/web-security/xss-rf-post/victim +++ b/web-security/xss-rf-post/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/" diff --git a/web-security/xss-stored-alert/victim b/web-security/xss-stored-alert/victim index e025a43..570c4b6 100755 --- a/web-security/xss-stored-alert/victim +++ b/web-security/xss-stored-alert/victim @@ -30,11 +30,6 @@ if 80 in open_ports: print("Port 80 is open. Will connect to the service there.") challenge_url = "http://challenge.localhost:80/" flag = open("/flag").read().strip() - if psutil.Process(next( - n for n in psutil.net_connections() - if n.status == "LISTEN" and n.laddr.port == 80 and n.family.value == 2 - )).uids().effective: - print("Service on port 80 is not owned by root... Aborting!") elif 8080 in open_ports: print("Port 8080 is open. Will connect to the service there. 8080 is the debug port, so you will earn a fake flag.") challenge_url = "http://challenge.localhost:8080/"