1
'''
2
I wish you a good head start.
3
flag is in file namely 'flag' in the same directory as this file.
4

5
Good luck!
6
'''
7

8
import re
9
import flask
10
import requests
11
import ipaddress
12
from urllib.parse import urlparse
13

14
GENERAL_WAF_REGEX = r'[a-zA-Z0-9_\[\]{}()<>,.!@#$^&*]{3}' # only two of these characters ;)
15

16
app = flask.Flask(__name__)
17

18
def general_waf(code):
19
    # Why do you need so many characters?
20
    if re.findall(GENERAL_WAF_REGEX, code):
21
        return True
22
    else:
23
        return False
24

25
def check_hostname(url):
26
    # must starts with vnctf.
27
    if not url.startswith('http://vnctf.'):
28
        return False
29

30
    hostname = urlparse(url).hostname
31
    query = urlparse(url).query
32

33
    # must only contain two of the restricted characters
34
    if general_waf(query):
35
        return False
36

37
    # must not be an ip address, so no 127.0.0.1 or ::1
38
    try:
39
        ipaddress.ip_address(hostname)
40
        return False
41
    except ValueError:
42
        pass
43

44
    return url
45

46
@app.route('/')
47
def index():
48
    return 'Welcome to MINI VNCTF 2025!'
49

50
@app.route('/fetch')
51
def fetch():
52
    url = flask.request.args.get('url')
53
    safe_url = check_hostname(url)
54
    if safe_url:
55
        try:
56
            response = requests.get(safe_url, allow_redirects=False) # no redirects
57
            return response.text
58
        except:
59
            return 'Error'
60
    else:
61
        return 'Invalid URL'
62

63
@app.route('/__internal/safe_eval')
64
def safe_eval():
65
    # check if the request is from the internal network
66
    if flask.request.remote_addr not in ['127.0.0.1', '::1']:
67
        return 'Forbidden'
68

69
    code = flask.request.args.get('hi')
70

71
    if len(code) >= 24 * 10 + 8 * 8:
72
        # Man! What can I say.
73
        return 'Invalid code'
74

75
    # Ah, if you get here, then your final challenge is to break this jail.
76
    # Try it. Not as hard as it seems ;)
77
    blacklist = ['\\x','+','join', '"', "'", '[', ']', '2', '3', '4', '5', '6', '7', '8', '9']
78
    for i in blacklist:
79
        if i in code:
80
            return 'Invalid code'
81

82
    safe_globals = {'__builtins__':None, 'lit':list, 'dic':dict}
83

84
    return repr(eval(code, safe_globals))
85

86
if __name__ == '__main__':
87
    app.run(debug=False, host='0.0.0.0', port=8080)

1
GENERAL_WAF_REGEX = r'[a-zA-Z0-9_\[\]{}()<>,.!@#$^&*]{3}' # only two of these characters ;)

1
def check_hostname(url):
2
    # must starts with vnctf.
3
    if not url.startswith('http://vnctf.'):
4
        return False
5

6
        hostname = urlparse(url).hostname
7
        query = urlparse(url).query
8

9
        # must only contain two of the restricted characters
10
        if general_waf(query):
11
            return False
12

13
        # must not be an ip address, so no 127.0.0.1 or ::1
14
        try:
15
            ipaddress.ip_address(hostname)
16
        return False
17
except ValueError:
18
        pass

1
@app.route('/__internal/safe_eval')
2
def safe_eval():
3
    # check if the request is from the internal network
4
    if flask.request.remote_addr not in ['127.0.0.1', '::1']:
5
        return 'Forbidden'
6

7
    code = flask.request.args.get('hi')
8

9
    if len(code) >= 24 * 10 + 8 * 8:
10
        # Man! What can I say.
11
        return 'Invalid code'
12

13
    # Ah, if you get here, then your final challenge is to break this jail.
14
    # Try it. Not as hard as it seems ;)
15
    blacklist = ['\\x','+','join', '"', "'", '[', ']', '2', '3', '4', '5', '6', '7', '8', '9']
16
    for i in blacklist:
17
        if i in code:
18
            return 'Invalid code'
19

20
    safe_globals = {'__builtins__':None, 'lit':list, 'dic':dict}
21

22
    return repr(eval(code, safe_globals))

1
# 从一个数字开始
2
1 .__class__              # <class 'int'>
3
1 .__class__.__base__     # <class 'object'>
4

5
# 从一个字符串开始
6
"" .__class__            # <class 'str'>
7
"" .__class__.__mro__    # (<class 'str'>, <class 'object'>)
8

9
# 从一个元组开始（本题用的）
10
() .__class__            # <class 'tuple'>
11
() .__class__.__base__   # <class 'object'>