Skip to content

Instantly share code, notes, and snippets.

@AndyNovo
Created November 27, 2023 12:31
Show Gist options
  • Save AndyNovo/03e98f2a06f36b7fd557afcbc785b942 to your computer and use it in GitHub Desktop.
Save AndyNovo/03e98f2a06f36b7fd557afcbc785b942 to your computer and use it in GitHub Desktop.
import sys
from io import StringIO
import json
import os
#https://8socqadtz9.execute-api.us-east-1.amazonaws.com/default/websecflag?payload=332a37
def lambda_handler(event, context):
flag = os.environ["flag"].encode()
assert(flag[:5] == b"ninja")
payload=bytes.fromhex(event["queryStringParameters"]["payload"])#hex encode please
for keyword in [b'eval', b'exec', b'import', b'open', b'os', b'read', b'system', b'write']:
if keyword in payload:
return {
'statusCode': 200,
'body': json.dumps('Banned')
}
old_stdout = sys.stdout
redirected_output = sys.stdout = StringIO()
exec(b"print(%b)" % (payload))
sys.stdout = old_stdout
return {
'statusCode': 200,
'body': redirected_output.getvalue()
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment