1
def bomb() do
2
    flag = case File.read("flag.txt") do
3
      {:ok, flag} -> flag
4
      {:error, _} -> "bctf{REDACTED}"
5
    end
6

7
    "The atom bomb detonated, and left in the crater there is a chunk of metal inscribed with #{flag}"
8
  end

1
def atomizer(params) when is_binary(params) do
2
  if String.at(params, 0) == ":" do
3
    atom_string = String.slice(params, 1..-1//1)
4
    case string_to_atom(atom_string) do
5
      {:ok, val} -> val
6
      :error -> nil
7
    end
8
  else
9
    params
10
  end
11
end

1
{
2
  "impact": ":bomb"
3
}

1
{"error":"function :bomb.bomb/0 is undefined (module :bomb is not available)"}

1
{
2
  "impact": {
3
    "bomb": ":Elixir.AtomBomb"
4
  }
5
}

1
-- Create database and read-only user
2
CREATE DATABASE IF NOT EXISTS app_db;
3
CREATE USER IF NOT EXISTS 'b01lers'@'%' IDENTIFIED BY 'redacted';
4
GRANT SELECT ON app_db.* TO 'b01lers'@'%';
5
FLUSH PRIVILEGES;
6

7
USE app_db;
8

9
-- Create users table
10
CREATE TABLE IF NOT EXISTS users (
11
    id INT AUTO_INCREMENT PRIMARY KEY,
12
    name VARCHAR(255) NOT NULL,
13
    email VARCHAR(255) NOT NULL UNIQUE
14
) ENGINE=InnoDB;
15

16
-- Create secrets table
17
CREATE TABLE IF NOT EXISTS secrets (
18
    id INT AUTO_INCREMENT PRIMARY KEY,
19
    `key` VARCHAR(255) NOT NULL,
20
    value TEXT NOT NULL
21
) ENGINE=InnoDB;
22

23
-- Insert sample data
24
INSERT IGNORE INTO users (name, email) VALUES
25
    ('neil', 'freshmen@purdue.eduuu'),
26
    ('gabe', 'boss@retirement.home'),
27
    ('kevin', 'frontend@kev.in');
28

29
INSERT IGNORE INTO secrets (`key`, value) VALUES
30
    ('junk', 'Wrong turn baby'),
31
    ('flag', 'bctf{tungtungtungtungtungsahua}');
32

33
-- Verify permissions
34
SHOW GRANTS FOR 'b01lers'@'%';

1
@app.route('/info/<path:name>', methods=['GET'])
2
def get_user_info(name):
3
    if len(name) > 100:
4
        return jsonify({"Message": "Why the long name? Are you Tung Tung Tung Tung Tung Tung Tung Sahua????"}), 403
5
    try:
6
        db = get_db()
7
        cursor = db.cursor()
8
    except Exception:
9
        print(traceback.format_exc())
10
        return jsonify({"Error": "Something very wrong happened, either retry or contact organizers if issue persists!"}), 500
11

12
    # Verify that the query is good and does not touch the secrets table
13
    #ok so this query stuff interacts with the sqlite
14
    query = f"SELECT * from users WHERE name = '{name}'"
15
    for item in BLACKLIST:
16
        if item in query:
17
            return jsonify({"Message": f"Probably sus"}), 403
18
    try:
19
        explain = "EXPLAIN QUERY PLAN " + query
20
        cursor.execute(explain)
21
        result = cursor.fetchall()
22
        if len(result) > 7:
23
            return jsonify({"Message": "Probably sus"}), 403
24
        for item in result:
25
            if "secrets" in item[3]:
26
                return jsonify({"Message": "I see where you're going..."}), 403
27
    except Exception as e:
28
        print(traceback.format_exc())
29
        return jsonify({"Message": f"Probably sus"}), 403
30

31
    # Now let the query through to the real production db
32

33
    cursor.close()
34
    # ohhh fetches the first instance?
35
    try:
36
        cur = mysql.connection.cursor()
37
        cur.execute(query)
38
        records = cur.fetchall()[0]
39
        cur.close()
40
        return str(records)
41
    except Exception as e:
42
        print(traceback.format_exc())
43
        return jsonify({'Error': "It did not work boss!"}), 400