{% extends "exercise_base.html" %}

{% block title %}{{ block.super }}Malicious Code Execution{% endblock %}

{% block header %}
    <h1>Malicious Code Execution</h1>
{% endblock %}

{% block content %}
    <p>There are often places where applications could be susceptible to
    malicious code execution attacks. Why? They use unsafe data formats and use
    <code>eval</code> and <code>exec</code> (among other things). All this and
    they are probably are not validating the input correctly.</p>

    <p>This attack is much harder, but very powerful. Imagine being able to run
    arbitrary snippets of code from outside of your firewall!</p>

    <p>Simple exercise: you're clever and you notice a base64 string in a
    hidden form field. Using a hacker-friendly tool you discover that the
    base64 string is Python dictionary that seems to be <code>eval</code>ed or
    <code>exec</code>ed and dropped into the JavaScript block on the resulting
    page. Let's take advantage of the <code>exec</code> and write to a file
    named <code>p0wned.txt</code>. Use a Python one-liner to open and write to
    the file.</p>

    <fieldset>
        <h2>Vulnerable Form</h2>
        <form method="POST">
            <label for="first_name">First Name:</label>
            <input name="first_name">
            <input type="submit">
        </form>
    </fieldset>

    {{ request.method}}
    {% if first_name %}
        {% if data %}
            <div class="answer panel">
                <p>Correct!  You are successfully executing arbitrary code on
                the server.  You wrote a file that says:</p>
                <code>{{ data }}</code>
            </div>
        {% else %}
            <div class="hints panel">
                <p>You didn't write the "p0wned.txt" file this time.</p>
                <p>Helpful hints:</p>
                <ul>
                <li>Use a Python one-liner to open and write to a file</li>
                <li>You don't need to specify the directory</li>
                <li>Don't forget the base64</li>
                <li>No need to include the newline from the base64 string</li>
                </ul>
                <a class="tiny button" id="show_solution">show solution</a>
            </div>
        {% endif %}
    {% endif %}
    <div class="solution panel"></div>

{% endblock %}

{% block extra_topnav %}
<li><a href="{% url 'injection-file-access' %}">Prev</a></li>
<li><a href="{% url 'broken-auth' %}">Next</a></li>
{% endblock %}

{% block extra_botnav %}
<li><a href="{% url 'injection-file-access' %}">Prev</a></li>
<li><a href="{% url 'xss' %}">Next</a></li>
{% endblock %}

{% block extra_js %}
{{ block.super }}
<script src="{{STATIC_URL}}js/exercises/injection-code-execution.js"></script>
{% endblock %}
