https://buuoj.cn/challenges#[RoarCTF%202019]Easy%20Java![BUUCTF：[RoarCTF 2019]Easy Java_php](https://s2.51cto.com/images/blog/202306/19154655_649007efd8dab64882.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_php_02](https://s2.51cto.com/images/blog/202306/19154655_649007efe98fc87690.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
登录框弱密码admin/admin888即可登录
![BUUCTF：[RoarCTF 2019]Easy Java_php_03](https://s2.51cto.com/images/blog/202306/19154656_649007f00844c73241.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
返回登录框，在下面有个help按钮
![BUUCTF：[RoarCTF 2019]Easy Java_xml_04](https://s2.51cto.com/images/blog/202306/19154656_649007f01ba4653145.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
GET传参无果，尝试修改传参方式为POST
![BUUCTF：[RoarCTF 2019]Easy Java_网站源码_05](https://s2.51cto.com/images/blog/202306/19154656_649007f0314cf36768.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
下载下来并无flag
![BUUCTF：[RoarCTF 2019]Easy Java_xml_06](https://s2.51cto.com/images/blog/202306/19154656_649007f04cfc745332.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
查看是否存在WEB-INF/web.xml泄露
![BUUCTF：[RoarCTF 2019]Easy Java_网站源码_07](https://s2.51cto.com/images/blog/202306/19154656_649007f05d27c99081.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
明显存在，可以读取到网站源码
![BUUCTF：[RoarCTF 2019]Easy Java_php_08](https://s2.51cto.com/images/blog/202306/19154656_649007f072b1069030.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
读取FlagController.class
filename=WEB-INF/classes/com/wm/ctf/FlagController.class![BUUCTF：[RoarCTF 2019]Easy Java_php_09](https://s2.51cto.com/images/blog/202306/19154656_649007f08f28f77232.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_xml_10](https://s2.51cto.com/images/blog/202306/19154656_649007f0a3b9121708.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_php_11](https://s2.51cto.com/images/blog/202306/19154656_649007f0b8a8c99127.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
PS C:\Users\Administrator> php -r "var_dump(base64_decode('ZmxhZ3tlMDA4NTdjYi1kODdhLTQ5OWMtYTcwYy00NjJlODBmZmEwOTh9Cg=='));"
string(43) "flag{e00857cb-d87a-499c-a70c-462e80ffa098}"
