# ▼▼▼Env(Web:100、51/696=7.3％)▼▼▼
This writeup is written by [**@kazkiti_ctf**](https://twitter.com/kazkiti_ctf)
---
```Einstein said, "time was relative, right?"
meme 1meme 2
http://104.154.106.182:6060
Author: maskofmydisguise```
---
```GET / HTTP/1.1Host: 104.154.106.182:6060```
↓
```HTTP/1.1 200 OKServer: gunicorn/19.9.0Date: Thu, 04 Apr 2019 13:18:33 GMTConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 607
<html><head>	<meta charset="UTF-8">	<meta name="viewport" content="width=device-width, initial-scale=1.0">	<meta http-equiv="X-UA-Compatible" content="ie=edge">	<meta name="description" content="My super totally awesome blog">	<title>My super totally awesome blog</title>	<style>	#timing {		margin: 50px 200px;		height:400px;		width: 200px;	}		</style></head><body>    	<div id="timing"> 	</div></body></html>```
↓
nothing!!
---
## 【Confirm Hint】
meme1
↓
![](https://raw.githubusercontent.com/kazkiti/CTF-image/master/encryptoctf_env_meme1.jpg)
---
meme2
↓
![](https://raw.githubusercontent.com/kazkiti/CTF-image/master/encryptoctf_env_meme2.jpg)
---
## 【Try 1: /home】
When I accessed `/home`, it was the **same** response as `/`.
---
## 【Try 2: /whatsthetime/】 ★★★important★★★
```GET /whatsthetime/ HTTP/1.1Host: 104.154.106.182:6060```
↓
404 response...
---
```GET /whatsthetime HTTP/1.1Host: 104.154.106.182:6060```
↓
```HTTP/1.1 200 OKServer: gunicorn/19.9.0Date: Thu, 04 Apr 2019 13:30:31 GMTConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 359
<html><head>	<meta charset="UTF-8">	<meta name="viewport" content="width=device-width, initial-scale=1.0">	<meta http-equiv="X-UA-Compatible" content="ie=edge">	<meta name="description" content="My super totally awesome blog v1.0">	<title>Almost there...or are you?</title></head><body> </body></html>```
↓
`Almost there...or are you?`
↓
**The response has changed!!** ★★important★★
---
## 【Try 3: you】
---
### 3-1:Try it for parameters
```GET /whatsthetime?you=test  →　Almost there...or are you?GET /whatsthetime?YOU=test  →　Almost there...or are you?```
↓
nothing....
---
### 3-2:Try it for path
```GET /you    　　　　　　　　→404 GET /homeyou    　　　　　  →404GET /youhome    　　　　　  →404GET /whatsthetime/you           →404```
↓
nothing....
---
## 【Try 4:other】
---
```GET /whatsthetime?timewasrelativeright →　Almost there...or are you?GET /whatsthetime/timewasrelativeright →　Almost there...or are you?GET /whatsthetimetimewasrelative       →　Almost there...or are you?GET /whatsthetimetimewasrelativeright  →　Almost there...or are you?GET /whatsthetime?e=mc2 　　　　　　　 →　Almost there...or are you?GET /whatsthetime?time=relative 　　   →　Almost there...or are you?GET /timewasrelativeright           →　404GET /timewasrelativeright           →　404GET /timewasrelative        　　　 →　404GET /timeisrelative        　　　 →　404```
↓
nothing....
---
## 【Try 5: Guess the problem from timing】　★★★important★★★
time , relative ,home , timing...
↓
I guess it would be better to send **the current time**
↓
The commonly used time in a PC is **Unixtime** 
---
## 【Try 6: Investigate where to insert Unixtime】　★★★important★★★
```GET /whatsthetime/12 HTTP/1.1Host: 104.154.106.182:6060```
↓
```HTTP/1.1 200 OKServer: gunicorn/19.9.0Date: Thu, 04 Apr 2019 13:44:32 GMTConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 353
<html><head>	<meta charset="UTF-8">	<meta name="viewport" content="width=device-width, initial-scale=1.0">	<meta http-equiv="X-UA-Compatible" content="ie=edge">	<meta name="description" content="My super totally awesome blog v1.0">	<title>Timing is a bitch!</title></head><body> </body></html>```
↓
`Timing is a bitch!`
↓
The response has changed!! 
---
## 【Try 7: Insert Unixtime at the current time】　★★★important★★★
```GET /whatsthetime/1554385615 HTTP/1.1Host: 104.154.106.182:6060```
↓
```HTTP/1.1 200 OKServer: gunicorn/19.9.0Date: Thu, 04 Apr 2019 13:46:55 GMTConnection: closeContent-Type: application/jsonContent-Length: 44
{"flag":"encryptCTF{v1rtualenvs_4re_c00l}"}```
↓
`encryptCTF{v1rtualenvs_4re_c00l}`
## ★★important★★They guess that they miss the combination of **ENV** and **shash shash** titles and problems...
**shash shash** → **/●●●/●●●**→**/whatsthetime/123**  can be easily imagined!!