XYCTF-2025-Web-Writeup
Web Signin 题目 1# -*- encoding: utf-8 -*- 2''' 3@File : main.py 4@Time : 2025/03/28 22:20:49 5@Author : LamentXU 6''' 7''' 8flag in /flag_{uuid4} 9''' 10from bottle import Bottle, request, response, redirect, static_file, run, route 11with open('../../secret.txt', 'r') as f: 12 secret = f.read() 13 14app = Bottle() 15@route('/') 16def index(): 17 return '''HI''' 18@route('/download') 19def download(): 20 name = request.query.filename 21 if '../../' in name or name.startswith('/') or name.startswith('../') or '\\' in name: 22 response.status = 403 23 return 'Forbidden' 24 with open(name, 'rb') as f: 25 data = f.read() 26 return data 27 28@route('/secret') 29def secret_page(): 30 try: 31 session = request.get_cookie("name", secret=secret) 32 if not session or session["name"] == "guest": 33 session = {"name": "guest"} 34 response.set_cookie("name", session, secret=secret) 35 return 'Forbidden!' 36 if session["name"] == "admin": 37 return 'The secret has been deleted!' 38 except: 39 return "Error!" 40run(host='0.0.0.0', port=8080, debug=False) 目录穿越拿secret ...