# Web Exploitation

## login

{% hint style="success" %}
Solved by ret2basic
{% endhint %}

### Challenge

My dog-sitter's brother made this website but I can't get in; can you help?

login.mars.picoctf.net

### Source Code

```javascript
'use strict';
(async() => {
  await new Promise((e) => {
    return window.addEventListener("load", e);
  });
  document.querySelector("form").addEventListener("submit", (event) => {
    event.preventDefault();
    const ids = {
      u : "input[name=username]",
      p : "input[name=password]"
    };
    const params = {};
    for (const i in ids) {
      /** @type {string} */
      params[i] = btoa(document.querySelector(ids[i]).value).replace(/=/g, "");
    }
    return "YWRtaW4" !== params.u ? alert("Incorrect Username") : "cGljb0NURns1M3J2M3JfNTNydjNyXzUzcnYzcl81M3J2M3JfNTNydjNyfQ" !== params.p ? alert("Incorrect Password") : void alert(`Correct Password! Your flag is ${atob(params.p)}.`);
  });
})();
```

### Solution

Base64 decode.

## caas

{% hint style="success" %}
Solved by ret2basic
{% endhint %}

### Challenge

Now presenting [cowsay as a service](https://caas.mars.picoctf.net)

[index.js](https://artifacts.picoctf.net/picoMini+by+redpwn/Web+Exploitation/caas/index.js)

### Source Code

```javascript
const express = require('express');
const app = express();
const { exec } = require('child_process');

app.use(express.static('public'));

app.get('/cowsay/:message', (req, res) => {
  exec(`/usr/games/cowsay ${req.params.message}`, (error, stdout) => {
    if (error) return res.status(500).end();
    res.type('txt').send(stdout).end();
  });
});

app.listen(3000, () => {
  console.log('listening');
});
```

### Solution

Command injection:

![Command injection](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-0175cfd66432622d01862b575bab98502ca71725%2Fimage.png?alt=media)
