exploit.py

from flask import Flask, request, render_template, abort
import os, requests

app = Flask(__name__)

class user:
    def __init__(self, username, password):
        self.username = username
        self.__password = password
        self.files = []
    def getPass(self):
        return self.__password

users = {}

users["admin"] = user("admin", os.environ["FLAG"])

def getInfo():
    val = users["admin"].getPass()
    if val != None: return val
    else: return "error"

getInfo()
if __name__ == "__main__": app.run(host="0.0.0.0")