s8ctf

package main

import (
    "fmt"
    "net/http"
    "os/exec"
    "regexp"
    "strings"
)

func main() {
    http.HandleFunc("/", handleIndex) // Serve index.html
    http.HandleFunc("/ping", handlePing) // Handle ping form submissions

    fmt.Println("Starting server on :8080")
    http.ListenAndServe(":8080", nil)
}

func handleIndex(w http.ResponseWriter, r *http.Request) {
    http.ServeFile(w, r, "index.html") // Serve the index.html file
}

func handlePing(w http.ResponseWriter, r *http.Request) {
    if r.Method == http.MethodPost {
        ip := r.FormValue("ip")
        if isValidIP(ip) {
            // Blacklist special characters
            blacklist := []string{"&", ";", "|", "$", "<", ">", "`", "\\", "'", "\"", "[", "]", "{", "}", "(", ")", "?", "#", "!"}
            for _, char := range blacklist {
                ip = strings.ReplaceAll(ip, char, "")
            }

            // Execute the shell command
            cmd := exec.Command("ping", "-c", "1", ip)
            output, err := cmd.CombinedOutput()
            if err != nil {
                fmt.Fprintf(w, "<pre>Error executing ping: %v</pre>", err)
                return
            }

            // Return the result in HTML format
            fmt.Fprintf(w, "<pre>%s</pre>", string(output))
        } else {
            fmt.Fprintf(w, "Invalid IP address.")
        }
    }
}

// Function to validate IP format
func isValidIP(ip string) bool {
    ipv4Regex := `^(([0-9]{1,3}\.){3}[0-9]{1,3})$`
    match, _ := regexp.MatchString(ipv4Regex, ip)
    return match
}