⭐ Add challenge

examples/Dockerfile

@@ -0,0 +1,13 @@
+from nikolaik/python-nodejs
+
+WORKDIR /home/pn/chall
+COPY src .
+COPY lunch.sh ./node
+
+WORKDIR /home/pn/chall/
+RUN python3 -m pip install -r python/requirements.txt
+
+WORKDIR /home/pn/chall/node
+RUN npm i
+
+CMD ["./lunch.sh"]

examples/README.md

@@ -0,0 +1,34 @@
+# Exemples
+
+## exploit.py
+Basic exemple file where you need to replace the leak function based on your needs.
+
+## Challenge
+The challenge contain a single Dockerfile with 2 apps :
+ * NodeJS app containing path traversal
+ * Flask app in debug mode
+
+The purpose of the challenge is to demonstrate the flexibility of the library even if the leak is not on the same app (but still on the same machine).
+### Build
+```bash
+docker build -t challenge:1.0.0 .
+```
+
+### Run
+```bash
+docker run --rm  -p 3000:3000 -p 5000:5000 challenge:1.0.0
+```
+
+### Solve
+Import requirements :
+
+```bash
+pip3 install requests beautifulsoup4 wconsole-extractor
+```
+
+Run the writeup :
+```bash
+python3 writeup.py
+```
+
+Check that the pin match the one displayed when the docker container is started.

examples/lunch.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+node index.js &
+python3 ../python/app.py

examples/src/node/index.js

@@ -0,0 +1,37 @@
+const express = require("express");
+const app = express();
+const path = require('path');
+const fs = require('fs')
+const port = 3000;
+
+app.set('view engine', 'ejs');
+app.use(express.static(path.join(__dirname, 'public')));
+
+
+app.get('/', (req,res) => {
+    res.render('index');
+});
+
+app.get('/about', (req,res) => {
+    res.render('about');
+});
+
+app.get('/file',(req,res) => {
+    if (req.query.search){
+        fs.readFile(req.query.search, 'utf-8', (err,data) => {
+            if (err) {
+                res.render('file', {content: 'File not found'});
+                return;
+            }
+            res.render('file', {content: data});
+        });
+    } else {
+        res.render('file', {content: "Search"});
+    }
+
+
+})
+
+app.listen(port, () => {
+    console.log(`Listening on port ${port}`);
+})