← Back to Writeups
CUSTOMEasyWeb
Bookmark

Palevo

XESXOR9/10/20261 min read
#web#custom#easy#apache_mod_status_disclosure#server_status_leak#linux

Palevo

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: apache_mod_status_disclosure, server_status_leak

Summary

A blog with hints about mod_status and DDoS.

Palevo — Web Kids 2.0

Description

A blog with hints about mod_status and DDoS.

URL: https://hy17-palevo.spb.ctf.su/

Analysis

The task is a blog with hints about mod_status and DDoS attacks. Apache mod_status is a module that provides information about the current server state, including active requests.

If /server-status is publicly accessible (misconfiguration), it can disclose:

  • Currently processed requests
  • URLs with parameters
  • Client IP addresses
  • Internal endpoints

Solution

  1. Read the hints in the blog about mod_status
  2. Accessed the standard Apache mod_status endpoint: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍
 bash 
curl https://hy17-palevo.spb.ctf.su/server-status
  1. On the server-status page, found a list of active requests
  2. One of the requests contained a URL with a secret parameter:
GET /readnews.php?rnd=REDACTED
  1. The flag was in the rnd parameter or in the response of this endpoint ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍