110 lines
4.0 KiB
Python
110 lines
4.0 KiB
Python
|
from .Challenge import Challenge
|
||
|
|
|
||
|
|
import requests
|
||
|
|
|
||
|
|
|
||
|
|
class Pasta(Challenge):
|
||
|
|
flag_location = 'flags/pasta.txt'
|
||
|
|
history_location = 'history/pasta.txt'
|
||
|
|
host = "http://localhost:13000"
|
||
|
|
|
||
|
|
def distribute(self, flag):
|
||
|
|
try:
|
||
|
|
with open(self.flag_location, 'w') as f:
|
||
|
|
f.write(flag)
|
||
|
|
|
||
|
|
with open(self.history_location, 'a') as f:
|
||
|
|
f.write(flag + '\n')
|
||
|
|
|
||
|
|
self.logger.info(f'Flag {flag} written to {self.flag_location}')
|
||
|
|
return True
|
||
|
|
|
||
|
|
except Exception as e:
|
||
|
|
self.logger.error(f'Could not write flag to {self.flag_location}: {e}')
|
||
|
|
return False
|
||
|
|
|
||
|
|
def check(self):
|
||
|
|
try:
|
||
|
|
url = f'http://localhost:{self.port}'
|
||
|
|
username = f"checker-{self.random_string(8)}"
|
||
|
|
pwd = self.random_string(12)
|
||
|
|
flag = open(self.flag_location).read()
|
||
|
|
|
||
|
|
admin_data = {
|
||
|
|
'username': 'deomkicer_number_1_fans',
|
||
|
|
'password': getattr(self.settings, f'PASSWORD_{self.port}'),
|
||
|
|
}
|
||
|
|
|
||
|
|
# login admin and check flag
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/auth",
|
||
|
|
json=admin_data).json()
|
||
|
|
|
||
|
|
token = response.get('token')
|
||
|
|
assert token, "Token is missing in login admin"
|
||
|
|
check_flag = requests.get(f"{url}/flag", headers={'Authorization': f"Bearer {token}"}).json()
|
||
|
|
assert check_flag.get('flag') == flag, "Flag is missing/mismatch"
|
||
|
|
|
||
|
|
# register
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/register",
|
||
|
|
json={
|
||
|
|
"username": f"{username}",
|
||
|
|
"password": f"{pwd}"}).json()
|
||
|
|
|
||
|
|
assert response.get('success') == "User registered succesfully", "Register failed"
|
||
|
|
|
||
|
|
# login with version 1
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/auth?version=1",
|
||
|
|
json={
|
||
|
|
"username": f"{username}",
|
||
|
|
"password": f"{pwd}"}).json()
|
||
|
|
|
||
|
|
token = response.get('token')
|
||
|
|
assert token, "Token is missing in login v1"
|
||
|
|
check_home = requests.get(f"{url}/", headers={'Authorization': f"Bearer {token}"}).json()
|
||
|
|
assert check_home.get('username') == username, "Different username found in login v1"
|
||
|
|
|
||
|
|
# login with version 2
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/auth?version=2",
|
||
|
|
json={
|
||
|
|
"username": f"{username}",
|
||
|
|
"password": f"{pwd}"}).json()
|
||
|
|
|
||
|
|
token = response.get('token')
|
||
|
|
assert token, "Token is missing in login v2"
|
||
|
|
check_home = requests.get(f"{url}/", headers={'Authorization': f"Bearer {token}"}).json()
|
||
|
|
assert check_home.get('username') == username, "Different username found in login v2"
|
||
|
|
|
||
|
|
# login with version 3
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/auth?version=3",
|
||
|
|
json={
|
||
|
|
"username": f"{username}",
|
||
|
|
"password": f"{pwd}"}).json()
|
||
|
|
|
||
|
|
token = response.get('token')
|
||
|
|
assert token, "Token is missing in login v3"
|
||
|
|
check_home = requests.get(f"{url}/", headers={'Authorization': f"Bearer {token}"}).json()
|
||
|
|
assert check_home.get('username') == username, "Different username found in login v3"
|
||
|
|
|
||
|
|
# login with version 4
|
||
|
|
response = requests.post(
|
||
|
|
f"{url}/auth?version=4",
|
||
|
|
json={
|
||
|
|
"username": f"{username}",
|
||
|
|
"password": f"{pwd}"}).json()
|
||
|
|
|
||
|
|
token = response.get('token')
|
||
|
|
assert token, "Token is missing in login v4"
|
||
|
|
check_home = requests.get(f"{url}/", headers={'Authorization': f"Bearer {token}"}).json()
|
||
|
|
assert check_home.get('username') == username, "Different username found in login v4"
|
||
|
|
|
||
|
|
return True
|
||
|
|
|
||
|
|
except Exception as e:
|
||
|
|
self.logger.error(f'Could not check pasta: {e}')
|
||
|
|
return False
|