https:///challenges#[RoarCTF%202019]Easy%20Java![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/ce366015437d4b12bead58440596950f.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/d4a29ce2404747668f58d35873ba3f52.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
登录框弱密码admin/admin888即可登录
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/feb840b968f2489c90078a6893fde969.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
返回登录框，在下面有个help按钮
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/5d801a54837a46cab0417faa4c313006.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
GET传参无果，尝试修改传参方式为POST
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/385dcb9c4ffe40afb607b40349ef3649.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
下载下来并无flag
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/0006c6f2e46c449692767fed6fc813c4.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
查看是否存在WEB-INF/web.xml泄露
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/3474ab6e8865469dab3d1d328334e7a5.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
明显存在，可以读取到网站源码
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/67109ec9227e481cb2e3ab1e7232d865.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
读取FlagController.class
filename=WEB-INF/classes/com/wm/ctf/FlagController.class![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/5c846fe522ab483cac8311c224670e4c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/51dad20dc2564bfb84cbe71bec4cc8bb.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
![BUUCTF：[RoarCTF 2019]Easy Java](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/eddbd9043562418c97c8774c23e20800.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[RoarCTF 2019]Easy Java")
PS C:\Users\Administrator> php -r "var_dump(base64_decode('ZmxhZ3tlMDA4NTdjYi1kODdhLTQ5OWMtYTcwYy00NjJlODBmZmEwOTh9Cg=='));"
string(43) "flag{e00857cb-d87a-499c-a70c-462e80ffa098}"
