Tags: web 

Rating: 4.0

# ▼▼▼Env(Web:100、51/696=7.3%)▼▼▼

This writeup is written by [**@kazkiti_ctf**](https://twitter.com/kazkiti_ctf)

---

```
Einstein said, "time was relative, right?"

meme 1
meme 2

http://104.154.106.182:6060

Author: maskofmydisguise
```

---

```
GET / HTTP/1.1
Host: 104.154.106.182:6060
```

```
HTTP/1.1 200 OK
Server: gunicorn/19.9.0
Date: Thu, 04 Apr 2019 13:18:33 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 607

<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<meta name="description" content="My super totally awesome blog">
<title>My super totally awesome blog</title>
<style>
#timing {
margin: 50px 200px;
height:400px;
width: 200px;
}
</style>
</head>
<body>




<div id="timing">

</div>
</body>
</html>
```

nothing!!

---

## 【Confirm Hint】

meme1

![](https://raw.githubusercontent.com/kazkiti/CTF-image/master/encryptoctf_env_meme1.jpg)

---

meme2

![](https://raw.githubusercontent.com/kazkiti/CTF-image/master/encryptoctf_env_meme2.jpg)

---

## 【Try 1: /home】

When I accessed `/home`, it was the **same** response as `/`.

---

## 【Try 2: /whatsthetime/】 ★★★important★★★

```
GET /whatsthetime/ HTTP/1.1
Host: 104.154.106.182:6060
```

404 response...

---

```
GET /whatsthetime HTTP/1.1
Host: 104.154.106.182:6060
```

```
HTTP/1.1 200 OK
Server: gunicorn/19.9.0
Date: Thu, 04 Apr 2019 13:30:31 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 359

<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<meta name="description" content="My super totally awesome blog v1.0">
<title>Almost there...or are you?</title>
</head>
<body>

</body>
</html>
```

`Almost there...or are you?`

**The response has changed!!** ★★important★★

---

## 【Try 3: you】

---

### 3-1:Try it for parameters

```
GET /whatsthetime?you=test → Almost there...or are you?
GET /whatsthetime?YOU=test → Almost there...or are you?
```

nothing....

---

### 3-2:Try it for path

```
GET /you         →404
GET /homeyou       →404
GET /youhome       →404
GET /whatsthetime/you →404
```

nothing....

---

## 【Try 4:other】

---

```
GET /whatsthetime?timewasrelativeright → Almost there...or are you?
GET /whatsthetime/timewasrelativeright → Almost there...or are you?
GET /whatsthetimetimewasrelative → Almost there...or are you?
GET /whatsthetimetimewasrelativeright → Almost there...or are you?
GET /whatsthetime?e=mc2         → Almost there...or are you?
GET /whatsthetime?time=relative    → Almost there...or are you?
GET /timewasrelativeright → 404
GET /timewasrelativeright → 404
GET /timewasrelative     → 404
GET /timeisrelative     → 404
```

nothing....

---

## 【Try 5: Guess the problem from timing】 ★★★important★★★

time , relative ,home , timing...

I guess it would be better to send **the current time**

The commonly used time in a PC is **Unixtime**

---

## 【Try 6: Investigate where to insert Unixtime】 ★★★important★★★

```
GET /whatsthetime/12 HTTP/1.1
Host: 104.154.106.182:6060
```

```
HTTP/1.1 200 OK
Server: gunicorn/19.9.0
Date: Thu, 04 Apr 2019 13:44:32 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 353

<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<meta name="description" content="My super totally awesome blog v1.0">
<title>Timing is a bitch!</title>
</head>
<body>

</body>
</html>
```

`Timing is a bitch!`

The response has changed!!

---

## 【Try 7: Insert Unixtime at the current time】 ★★★important★★★

```
GET /whatsthetime/1554385615 HTTP/1.1
Host: 104.154.106.182:6060
```

```
HTTP/1.1 200 OK
Server: gunicorn/19.9.0
Date: Thu, 04 Apr 2019 13:46:55 GMT
Connection: close
Content-Type: application/json
Content-Length: 44

{"flag":"encryptCTF{v1rtualenvs_4re_c00l}"}
```

`encryptCTF{v1rtualenvs_4re_c00l}`

## ★★important★★
They guess that they miss the combination of **ENV** and **shash shash** titles and problems...

**shash shash** → **/●●●/●●●**→**/whatsthetime/123** can be easily imagined!!