1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
| from flask import Flask, abort, session, request, redirect, url_for, render_template, render_template_string, jsonify
from utils import waf, key
app = Flask(__name__)
app.config['SECRET_KEY'] = 'ctfshow5201314'
app.config['SESSION_COOKIE_NAME'] = 'user'
users = {}
valid_urls = ['/logout', '/', '/echo', '/secret', '/register', '/login', '/chat']
class CTFer:
def __init__(self, username, password):
self.username = username
self.password = password
self.is_admin = 0
def merge(src, dst):
for k, v in src.items():
if hasattr(dst, '__getitem__'):
if dst.get(k) and isinstance(v, dict):
merge(v, dst.get(k))
else:
dst[k] = v
elif hasattr(dst, k) and isinstance(v, dict):
merge(v, getattr(dst, k))
else:
setattr(dst, k, v)
def require_valid_url(f):
def wrapper(*args, **kwargs):
if request.path not in valid_urls:
return jsonify({"status": "fail", "message": "Access denied"}), 403
return f(*args, **kwargs)
wrapper.__name__ = f.__name__
return wrapper
@app.route('/')
@require_valid_url
def index():
if 'username' in session:
return render_template('index.html', username=session['username'], echo_message=session.get('echo_message'))
return render_template('index.html', echo_message=session.get('echo_message'))
@app.route('/register', methods=['GET', 'POST'])
@require_valid_url
def register():
if request.method == 'POST':
if request.is_json:
username = request.json.get('username')
password = request.json.get('password')
if username in users:
return jsonify({"status": "fail", "message": "Username already exists"}), 400
ctfer = CTFer(username, password)
merge(request.json, ctfer)
users[ctfer.username] = {'password': ctfer.password, 'is_admin': ctfer.is_admin}
return jsonify({"status": "success", "message": "Yeah~ You succeeded!"})
data = request.form.to_dict(flat=False)
username = data.get('username', [''])[0]
password = data.get('password', [''])[0]
if username in users:
return 'Username already exists', 400
users[username] = {'password': password, 'is_admin': 0}
return redirect(url_for('login'))
return render_template('register.html')
@app.route('/login', methods=['GET', 'POST'])
@require_valid_url
def login():
if request.method == 'POST':
username = request.form.get('username')
password = request.form.get('password')
if username in users and users[username]['password'] == password:
session['username'] = username
session['is_admin'] = users[username]['is_admin']
return redirect(url_for('index'))
else:
return 'Invalid credentials'
return render_template('login.html')
@app.route('/logout')
@require_valid_url
def logout():
session.pop('username', None)
session.pop('is_admin', None)
return redirect(url_for('index'))
@app.route('/chat')
@require_valid_url
def chat():
return render_template('chat.html')
@app.route('/secret')
@require_valid_url
def secret():
if 'is_admin' in session and session['is_admin'] == 1:
with open('secret.txt', 'r') as file:
secret_content = file.read()
return render_template('secret.html', secret_content=secret_content)
else:
return render_template('access_denied.html'), 403
@app.route('/echo', methods=['POST'])
@require_valid_url
def echo():
message = request.form.get('message')
session['echo_message'] = message
if 'is_admin' in session and session['is_admin'] == 1:
if key(message):
if waf(message):
template = 'your answer is {{%s}}' % session['echo_message']
try:
render_template_string(template)
session['echo_message'] = render_template_string(template)
except:
abort(404)
return redirect(url_for('index'))
else:
session['echo_message'] = 'You can bypass it!'
return redirect(url_for('index'))
else:
return redirect(url_for('index'))
if __name__ == '__main__':
app.run(host="0.0.0.0", port=5000)
|
