64 lines
2.4 KiB
PHP
64 lines
2.4 KiB
PHP
<?php
|
|
// insecure.newploit.com :: landing + SSTI + CORS misconfig
|
|
// Every endpoint here is intentionally vulnerable.
|
|
|
|
// ---- CORS misconfig: reflect any Origin + allow-credentials ----
|
|
if (!empty($_SERVER['HTTP_ORIGIN'])) {
|
|
header("Access-Control-Allow-Origin: " . $_SERVER['HTTP_ORIGIN']);
|
|
header("Access-Control-Allow-Credentials: true");
|
|
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
|
|
header("Access-Control-Allow-Headers: *");
|
|
}
|
|
|
|
header("X-Powered-By: PHP/8.2.12");
|
|
header("Server: Apache/2.4.57 (Debian) OpenSSL/3.0.11");
|
|
|
|
// ---- Fake template engine: renders {{ expr }} inside `name` param ----
|
|
// Handles both Jinja2-style math (999*777) and Twig-style filter ('x'|upper).
|
|
function fake_render($input) {
|
|
return preg_replace_callback('/\{\{\s*(.+?)\s*\}\}/', function ($m) {
|
|
$expr = trim($m[1]);
|
|
// Twig-style: 'text'|upper or "text"|upper
|
|
if (preg_match('/^[\'\"]([^\'\"]*)[\'\"]\s*\|\s*upper$/', $expr, $mm)) {
|
|
return strtoupper($mm[1]);
|
|
}
|
|
if (preg_match('/^[\'\"]([^\'\"]*)[\'\"]\s*\|\s*lower$/', $expr, $mm)) {
|
|
return strtolower($mm[1]);
|
|
}
|
|
// Math: digits + operators only
|
|
if (preg_match('/^[\d\s\+\-\*\/\(\)\.]+$/', $expr)) {
|
|
$r = 0;
|
|
try { @eval('$r = ' . $expr . ';'); } catch (\Throwable $e) {}
|
|
return (string)$r;
|
|
}
|
|
return '';
|
|
}, $input);
|
|
}
|
|
|
|
$name = $_POST['name'] ?? $_GET['name'] ?? $_GET['q'] ?? 'guest';
|
|
$rendered = fake_render($name);
|
|
?><!DOCTYPE html>
|
|
<html><head>
|
|
<title>Newploit :: insecure test lab</title>
|
|
<meta name="generator" content="Newploit CMS 1.2.0">
|
|
</head><body>
|
|
<h1>Welcome to insecure.newploit.com</h1>
|
|
<p>Hello <?= $rendered ?>, this is the dev test box. Nothing to see here.</p>
|
|
|
|
<h2>Quick links</h2>
|
|
<ul>
|
|
<li><a href="/search.php?q=test">search</a></li>
|
|
<li><a href="/profile.php?id=1">profile</a></li>
|
|
<li><a href="/login.php">login</a></li>
|
|
<li><a href="/page.php?page=home">page viewer</a></li>
|
|
<li><a href="/fetch.php?url=https://example.com">link fetcher</a></li>
|
|
<li><a href="/redirect.php?url=https://google.com">redirect</a></li>
|
|
<li><a href="/api/auth.php">api auth</a></li>
|
|
<li><a href="/phpinfo.php">server info</a></li>
|
|
<li><a href="/admin/">admin</a></li>
|
|
<li><a href="/wp-login.php">blog login</a></li>
|
|
</ul>
|
|
|
|
<!-- DEBUG: template=<?= htmlspecialchars($name) ?> -->
|
|
</body></html>
|