The goal of this challenge is to get command execution on the flask_app container, and grab the file /FLAG.txt
\n| Name | \nURL | \nMapping | \n
|---|---|---|
| Nginx Root | \nhttp://nginx:80/ | \nhttp://nginx:80/ | \n
| Flask App | \nhttp://flask_app:8080 | \nhttp://nginx:80/app/ | \n
| Flask API | \nhttp://flask_api:8081 | \nhttp://nginx:8081/ | \n
The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
\n\n\n=== /app/name/get === 404 len 207 sha e9639e3c4681 time 0.003 ct text/html; charset=utf-8\n\n\nThe requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
\n\n\n=== /app/api/get === 404 len 207 sha e9639e3c4681 time 0.002 ct text/html; charset=utf-8\n\n\nThe requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
\n\n\n=== /script === 404 len 153 sha 7389d293a8d5 time 0.001 ct text/html\n\r\nThe requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
\n\n\n=== /api/set === 400 len 15 sha 330509caa0f2 time 0.001 ct text/plain\nInvalid request\n\n=== /name/set === 400 len 22 sha ce1f8cddf239 time 0.001 ct text/plain\nMissing name parameter\n\nSET /name/set {'name': 'Test123'} => 200 24 Hostname set to: Test123\nGET name 200 Test123\n\nSET /name/set {'name': '$(id)'} => 200 22 Hostname set to: $(id)\nGET name 200 $(id)\n\nSET /name/set {'name': '`id`'} => 200 21 Hostname set to: `id`\nGET name 200 `id`\n\nSET /name/set {'name': 'A;id'} => 200 21 Hostname set to: A;id\nGET name 200 A;id\n\nSET /api/set {'url': 'http://flask_api:8081/script'} => 200 44 API URL set to: http://flask_api:8081/script\nGET api 200 28\nhttp://flask_api:8081/script\n\nSET /api/set {'url': 'http://nginx:80/'} => 200 32 API URL set to: http://nginx:80/\nGET api 200 16\nhttp://nginx:80/\n\nSET /api/set {'url': 'http://flask_app:8080/'} => 200 38 API URL set to: http://flask_app:8080/\nGET api 200 22\nhttp://flask_app:8080/\n\n[stderr]\n/home/user/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020\n warnings.warn(\n\n('/api/get', 200, 22, 'f85dfe5cfd04', 'text/plain', 'http://flask_app:8080/')\n('/api/set', 400, 15, '330509caa0f2', 'text/plain', 'Invalid request')\n('/app', 500, 17515, '240b1167e995', 'text/html; charset=utf-8', 'json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n
\n__call__ ) -> cabc.Iterable[bytes]:\n """The WSGI server calls the Flask application object as the\n WSGI application. This calls :meth:`wsgi_app`, which can be\n wrapped to apply middleware.\n """\n return self.wsgi_app(environ, start_response)wsgi_app try:\n ctx.push()\n response = self.full_dispatch_request()\n except Exception as e:\n error = e\n response = self.handle_exception(e)\n except: # noqa: B001\n error = sys.exc_info()[1]\n raise\n return response(environ, start_response)\n finally:wsgi_app ctx = self.request_context(environ)\n error: BaseException | None = None\n try:\n try:\n ctx.push()\n response = self.full_dispatch_request()\n except Exception as e:\n error = e\n response = self.handle_exception(e)\n except: # noqa: B001\n error = sys.exc_info()[1]full_dispatch_request request_started.send(self, _async_wrapper=self.ensure_sync)\n rv = self.preprocess_request()\n if rv is None:\n rv = self.dispatch_request()\n except Exception as e:\n rv = self.handle_user_exception(e)\n return self.finalize_request(rv)\n\n
def finalize_request(\n self,\n rv: ft.ResponseReturnValue | HTTPException,full_dispatch_request\n
try:\n request_started.send(self, _async_wrapper=self.ensure_sync)\n rv = self.preprocess_request()\n if rv is None:\n rv = self.dispatch_request()\n except Exception as e:\n rv = self.handle_user_exception(e)\n return self.finalize_request(rv)\n\n
def finalize_request(dispatch_request and req.method == "OPTIONS"\n ):\n return self.make_default_options_response()\n # otherwise dispatch to the handler for that endpoint\n view_args: dict[str, t.Any] = req.view_args # type: ignore[assignment]\n return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]\n\n
def full_dispatch_request(self) -> Response:\n """Dispatches the request and on top of that performs request\n pre and postprocessing as well as HTTP exception catching and\n error handling.home\n
@app.route('/app')\ndef home():\n
api = requests.get('http://nginx/api/get').text\n script = requests.get(api).text\n eval_result = eval(json.loads(script)["script"]) # Be cautious with eval due to security risks\n\n
name = requests.get('http://nginx/name/get').text\n #eval_result = api_script\n\n
return render_template('index.html', api=api, name=name, eval_result=eval_result)loads del kw['encoding']\n\n
if (cls is None and object_hook is None and\n parse_int is None and parse_float is None and\n parse_constant is None and object_pairs_hook is None and not kw):\n return _default_decoder.decode(s)\n if cls is None:\n cls = JSONDecoder\n if object_hook is not None:\n kw['object_hook'] = object_hook\n if object_pairs_hook is not None:decode def decode(self, s, _w=WHITESPACE.match):\n """Return the Python representation of ``s`` (a ``str`` instance\n containing a JSON document).\n\n
"""\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n end = _w(s, end).end()\n if end != len(s):\n raise JSONDecodeError("Extra data", s, end)\n return obj\nraw_decode\n
"""\n try:\n obj, end = self.scan_once(s, idx)\n except StopIteration as err:\n raise JSONDecodeError("Expecting value", s, err.value) from None\n return obj, endjson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n\n
\n This is the Copy/Paste friendly version of the traceback.\n
\n \n\n The console is locked and needs to be unlocked by entering the PIN.\n You can find the PIN printed out on the standard output of your\n shell that runs the \n\u2026[truncated, 16334 bytes total \u2014 narrow with head/tail/grep]\nAPI URL set to: http://flask_api:8081/script\nHostname set to: Cocomelon\nAPP 200 1020 text/html; charset=utf-8\n\n\n
\n \n \n