Palevo

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: apache_mod_status_disclosure, server_status_leak

Summary

Walkthrough of the CUSTOM Web Palevo. A blog with hints about mod_status and DDoS.

Description

A blog with hints about mod_status and DDoS.

URL: https://hy17-palevo.spb.ctf.su/

Analysis

The task is a blog with hints about mod_status and DDoS attacks. Apache mod_status is a module that provides information about the current server state, including active requests.

If /server-status is publicly accessible (misconfiguration), it can disclose:

• Currently processed requests
• URLs with parameters
• Client IP addresses
• Internal endpoints

Solution

1. Read the hints in the blog about mod_status
2. Accessed the standard Apache mod_status endpoint: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl https://hy17-palevo.spb.ctf.su/server-status

1. On the server-status page, found a list of active requests
2. One of the requests contained a URL with a secret parameter:

GET /readnews.php?rnd=REDACTED

1. The flag was in the rnd parameter or in the response of this endpoint ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering apache_mod_status_disclosure, server_status_leak was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Palevo • Difficulty: Easy