index.js

"use strict";
const express = require("express");
const path = require("path");
const mysql = require('mysql');
const { exec } = require("child_process");

const app = express();

const PORT = process.env.PORT || 3000;

const pagesDir = path.join(__dirname, "public/");

let connection2 = mysql.createConnection({
	host: 'localhost',
	user: 'web2',
	password: 'HyXrA56ESnzUKrW',
	database: 'web2'

});

connection2.connect(function(err) {
	if (err) {
		return console.error('error: ' + err.message);
	}

	console.log('Web2 connected to the MySQL server.');
});

let connection3 = mysql.createConnection({
	host: 'localhost',
	user: 'web3',
	password: 'wi8228Sc',
	database: 'web3'
});

connection3.connect(function(err) {
	if (err) {
		return console.error('error: ' + err.message);
	}

	console.log('Web3 connected to the MySQL server.');
});

app.use(
	express.static(path.join(__dirname, "public")),
	express.urlencoded({ extended: true })
);

app.get("/1", (_, res) => {
	return res.sendFile(path.join(pagesDir, "web1.html"));
});

app.get("/2", (_, res) => {
	return res.sendFile(path.join(pagesDir, "web2.html"));
});

app.get("/3", (_, res) => {
	return res.sendFile(path.join(pagesDir, "web3.html"));
});

app.post("/api", (req, res) => {
	const ipAddress = req.body.ipaddress.replaceAll("'", "");

	exec(`runuser -l web_user -c '/bin/rbash -r -c "ping -c 1 ${ipAddress}"'`, 
	(err, stdout, stderr) => {
		if (err) {
			return res.send(stderr);
		} else {
			return res.send(stdout);
			
		}
	});
});

app.post("/api2", (req, res) => {
	const item = req.body.item;

	connection2.query(`SELECT * FROM Products WHERE item_name LIKE "%${item}%";`, function (err, result, fields) {
		if (err) {
			console.error('error: ' + err.message);
			return res.send(err.message);
		} else {
			return res.send(result);
		}
	});

});

app.post("/api3", (req, res) => {
	const key = req.body.key;
        
	connection3.query(`SELECT * FROM SECRETS WHERE name='flag' AND value='${key}';`, function (err, result, fields) {
            if (err) {
		    return res.send(err);
	    } else {
		    if (result.length === 0) {
		            return res.send(`"${key}" is not the flag`)
		    } else {
			    return res.send(`"${key}" is the flag! Well done!`);
		    }
	    }
	});

});

app.listen(3000);
console.log(`Listening on port ${PORT}`);