https://buuoj.cn/challenges#[RoarCTF%202019]Easy%20Java![BUUCTF：[RoarCTF 2019]Easy Java_xml](https://file.cfanz.cn/uploads/png/2023/06/19/16/1f57J612Y6.png "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_网站源码_02](https://file.cfanz.cn/uploads/png/2023/06/19/16/1E6aIf87ee.png "在这里插入图片描述")
登录框弱密码admin/admin888即可登录
![BUUCTF：[RoarCTF 2019]Easy Java_php_03](https://file.cfanz.cn/uploads/png/2023/06/19/16/25ZTe4feLW.png "在这里插入图片描述")
返回登录框，在下面有个help按钮
![BUUCTF：[RoarCTF 2019]Easy Java_xml_04](https://file.cfanz.cn/uploads/png/2023/06/19/16/005b4aQ5IW.png "在这里插入图片描述")
GET传参无果，尝试修改传参方式为POST
![BUUCTF：[RoarCTF 2019]Easy Java_xml_05](https://file.cfanz.cn/uploads/png/2023/06/19/16/OC9FF77661.png "在这里插入图片描述")
下载下来并无flag
![BUUCTF：[RoarCTF 2019]Easy Java_xml_06](https://file.cfanz.cn/uploads/png/2023/06/19/16/Kbe6656F00.png "在这里插入图片描述")
查看是否存在WEB-INF/web.xml泄露
![BUUCTF：[RoarCTF 2019]Easy Java_php_07](https://file.cfanz.cn/uploads/png/2023/06/19/16/97EZ6434Y1.png "在这里插入图片描述")
明显存在，可以读取到网站源码
![BUUCTF：[RoarCTF 2019]Easy Java_php_08](https://file.cfanz.cn/uploads/png/2023/06/19/16/UG4UF3Fd00.png "在这里插入图片描述")
读取FlagController.class
filename=WEB-INF/classes/com/wm/ctf/FlagController.class![BUUCTF：[RoarCTF 2019]Easy Java_xml_09](https://file.cfanz.cn/uploads/png/2023/06/19/16/CJO9P3IEDe.png "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_xml_10](https://file.cfanz.cn/uploads/png/2023/06/19/16/RL11b94cK1.png "在这里插入图片描述")
![BUUCTF：[RoarCTF 2019]Easy Java_网站源码_11](https://file.cfanz.cn/uploads/png/2023/06/19/16/CMT711Pd92.png "在这里插入图片描述")
PS C:\Users\Administrator> php -r "var_dump(base64_decode('ZmxhZ3tlMDA4NTdjYi1kODdhLTQ5OWMtYTcwYy00NjJlODBmZmEwOTh9Cg=='));"
string(43) "flag{e00857cb-d87a-499c-a70c-462e80ffa098}"
