mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
26 lines
503 B
Go
26 lines
503 B
Go
// Phase 17 (Track L.15) — echo benign control fixture.
|
|
//
|
|
// The /run route consults an allow-list before invoking exec, so
|
|
// attacker bytes never reach the sink directly.
|
|
package main
|
|
|
|
import (
|
|
"os/exec"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
func Run(c echo.Context) error {
|
|
cmd := c.QueryParam("cmd")
|
|
allow := map[string]string{"ls": "ls", "ps": "ps"}
|
|
if safe, ok := allow[cmd]; ok {
|
|
return exec.Command(safe).Run()
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func main() {
|
|
e := echo.New()
|
|
e.GET("/run", Run)
|
|
_ = e
|
|
}
|