HFCTF-2021-Final-easyflask

虽然是五一布置的作业，然而五一的时候完全不会。才对flask有一点点了解，过来写写这个试试吧，希望可以多做一些步骤。

根据页面指示，在file?file=/app/source得到源码：

#!/usr/bin/python3.6
from flask import Flask, request, render_template, session
from base64 import b64decode
import pickle
import os

app = Flask(__name__)
app.config["SECRET_KEY"] = "*******"
User = type(
    'User', (object,),
    {
        'uname': 'test',
        'is_admin': 0,
        '__repr__': lambda
        o: o.uname,
    }
)


@ app.route('/', methods=('GET',))
def index_handler():
    if not session.get('u'):
        u = pickle.dumps(User())
        session['u'] = u
        return "/file?file=index.js"


@ app.route('/file', methods=('GET',))
def file_handler():
    path = request.args.get('file')
    path = os.path.join('static', path)
    if not os.path.exists(path) or os.path.isdir(path) or '.py' in path or '.sh' in path or '..' in path or "flag" in path:
        return 'disallowed'

    with open(path, 'r') as fp:
        content = fp.read()
        return content


@ app.route('/admin', methods=('GET',))
def admin_handler():
    try:
        u = session.get('u')
        if isinstance(u, dict):
            u = b64decode(u.get('b'))
            u = pickle.loads(u)
    except Exception:
        return 'uhh?'
    if u.is_admin == 1:
        return 'welcome, admin'
    else:
        return 'who are you?'


if __name__ == '__main__':
    app.run('0.0.0.0', port=80, debug=False)