unexploitable

from flask import Flask, Response, render_template, session, request, jsonify, send_file
import os
from subprocess import run, STDOUT, PIPE, CalledProcessError
from base64 import b64decode, b64encode

app = Flask(__name__)
app.secret_key = open('private/secret.txt').read()

keys = {
	'key1': open('tmp/key1').read().strip(),
	'key2': open('tmp/key2').read().strip()
}


@app.route('/')
def main():
	if session.get('level') == None:
		session['level'] = 0
	
	return render_template('index.html', name="CNV", level = session['level'])

	
@app.route('/source', methods=['GET'])
def resouce():
	file_name = request.args.get('name')
	if '/' in file_name or '..' in file_name or 'private' in file_name:
		return 'Access Denied'
	file_path = 'tmp/' + file_name
	if os.path.isfile(file_path):
		return send_file(file_path)
	else:
		return render_template('index.html', name="CNV", level = session['level'])

		
@app.route('/exploit', methods=['POST'])
def exploit():
	if session.get('level') <= 1:
		return jsonify({'result': 'Only for supper user!'})
	
	try:
		data = request.get_json(force=True)
	except Exception:
		return jsonify({'result': 'Wrong data!'})
	
	try:
		payload = b64decode(data['payload'].encode())
	except TypeError:
		return jsonify({'result': 'Wrong data!'})
		
	try:
		result = run(['nc', 'localhost', '9999'], input=payload, stdout=PIPE, stderr=STDOUT, timeout=2, check=True).stdout
	except CalledProcessError:
		return jsonify({'result': 'Error run file!'})
		
	return jsonify({'result': result.decode()})
		

@app.route('/upto', methods=['POST'])
def upto():
	try:
		data = request.get_json(force=True)
	except Exception:
		return jsonify({'result': 'Wrong data!'})
	
	try:
		if session['level'] == 0 and data['type'] == 'key1' and data['key'] == keys['key1']:
			session['level'] = 1
			return jsonify({'result': 'Up to level 1!'})
		
		if session['level'] == 1 and data['type'] == 'key2' and data['key'] == keys['key2']:
			session['level'] = 2
			return jsonify({'result': 'Up to level 2!'})
	except Exception:
		return jsonify({'result': 'Wrong data!'})
	
	return jsonify({'result': 'Wrong key!'})
	
if __name__ == '__main__':
	app.run(host='0.0.0.0', port=8080)