INNER CODE UNIT · Python

upload_file

project-sekai-ctf/sekaictf-2025 · pwn/umiyuri-kaikeitan/challenge/app/app.py:62

def upload_file():
    form = UploadForm()
    if form.validate_on_submit():
        file = form.file.data
        if file and allowed_file(file.filename):
            # Save file to the tmp folder
            filename = secure_filename(file.filename)
            filepath = os.path.join(app.config["UPLOAD_FOLDER"], filename)
            file.save(filepath)

            # Package the payload in a ZIP with the vulnerable exe
            zip_filename = os.path.join("/tmp", f"{uuid.uuid4()}.zip")
            with ZipFile(app.config["ZIP_TEMPLATE"], "r") as zip_tmpl:
                with ZipFile(zip_filename, "w") as zip_pl:
                    for item in zip_tmpl.infolist():
                        zip_pl.writestr(
                            item, zip_tmpl.read(item.filename, pwd=b"infected")
                        )

View source record →