1
#!/usr/bin/python3
2
from flask import Flask, request, render_template, g
3
import sqlite3
4
import os
5
import binascii
6

7
app = Flask(__name__)
8
app.secret_key = os.urandom(32)
9

10
try:
11
    FLAG = open('./flag.txt', 'r').read()
12
except:
13
    FLAG = '[**FLAG**]'
14

15
DATABASE = "database.db"
16
if os.path.exists(DATABASE) == False:
17
    db = sqlite3.connect(DATABASE)
18
    db.execute(
19
        'create table users(userid char(100), userpassword char(100), userlevel integer);')
20
    db.execute(
21
        f'insert into users(userid, userpassword, userlevel) values ("guest", "guest", 0), ("admin", "{binascii.hexlify(os.urandom(16)).decode("utf8")}", 0);')
22
    db.commit()
23
    db.close()
24

25

26
def get_db():
27
    db = getattr(g, '_database', None)
28
    if db is None:
29
        db = g._database = sqlite3.connect(DATABASE)
30
    db.row_factory = sqlite3.Row
31
    return db
32

33

34
def query_db(query, one=True):
35
    cur = get_db().execute(query)
36
    rv = cur.fetchall()
37
    cur.close()
38
    return (rv[0] if rv else None) if one else rv
39

40

41
@app.teardown_appcontext
42
def close_connection(exception):
43
    db = getattr(g, '_database', None)
44
    if db is not None:
45
        db.close()
46

47

48
@app.route('/')
49
def index():
50
    return render_template('index.html')
51

52

53
@app.route('/login', methods=['GET', 'POST'])
54
def login():
55
    if request.method == 'GET':
56
        return render_template('login.html')
57
    else:
58
        userlevel = request.form.get('userlevel')
59
        res = query_db(f"select * from users where userlevel='{userlevel}'")
60
        if res:
61
            userid = res[0]
62
            userlevel = res[2]
63
            print(userid, userlevel)
64
            if userid == 'admin' and userlevel == 0:
65
                return f'hello {userid} flag is {FLAG}'
66
            return f'<script>alert("hello {userid}");history.go(-1);</script>'
67
        return '<script>alert("wrong");history.go(-1);</script>'
68

69

70
app.run(host='0.0.0.0', port=8000)