红明谷CTF

package com.example.controller;

import com.example.utils.Utils;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.File;
import java.io.FileWriter;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.URL;
import java.util.concurrent.TimeUnit;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class CurlController {
    private static final String RESOURCES_DIRECTORY = "resources";
    private static final String SAVE_DIRECTORY = "sites";

    public CurlController() {
    }

    @RequestMapping({"/curl"})
    public String curl(@RequestParam String url, HttpServletRequest request, HttpServletResponse response) throws Exception {
        if (!url.startsWith("http:") && !url.startsWith("https:")) {
            System.out.println(url.startsWith("http"));
            return "No protocol: " + url;
        } else {
            URL urlObject = new URL(url);
            String result = "";
            String hostname = urlObject.getHost();
            if (hostname.indexOf("../") != -1) {
                return "Illegal hostname";
            } else {
                InetAddress inetAddress = InetAddress.getByName(hostname);
                if (Utils.isPrivateIp(inetAddress)) {
                    return "Illegal ip address";
                } else {
                    try {
                        String savePath = System.getProperty("user.dir") + File.separator + "resources" + File.separator + "sites";
                        File saveDir = new File(savePath);
                        if (!saveDir.exists()) {
                            saveDir.mkdirs();
                        }

                        TimeUnit.SECONDS.sleep(4L);
                        HttpURLConnection connection = (HttpURLConnection)urlObject.openConnection();
                        if (connection instanceof HttpURLConnection) {
                            connection.connect();
                            int statusCode = connection.getResponseCode();
                            if (statusCode == 200) {
                                BufferedReader reader = new BufferedReader(new InputStreamReader(connection.getInputStream()));

                                BufferedWriter writer;
                                String line;
                                for(writer = new BufferedWriter(new FileWriter(savePath + File.separator + hostname + ".html")); (line = reader.readLine()) != null; result = result + line + "\n") {
                                }

                                writer.write(result);
                                reader.close();
                                writer.close();
                            }
                        }

                        return result;
                    } catch (Exception var15) {
                        return var15.toString();
                    }
                }
            }
        }
    }
}

package com.example.controller;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.thymeleaf.TemplateEngine;
import org.thymeleaf.context.Context;
import org.thymeleaf.spring5.SpringTemplateEngine;

@Controller
public class AdminController {
    public AdminController() {
    }

    @GetMapping({"/getsites"})
    public String admin(@RequestParam String hostname, HttpServletRequest request, HttpServletResponse response) throws Exception {
        String ipAddress = request.getRemoteAddr();
        if (!ipAddress.equals("127.0.0.1")) {
            response.setStatus(HttpStatus.FORBIDDEN.value());
            return "forbidden";
        } else {
            Context context = new Context();
            TemplateEngine engine = new SpringTemplateEngine();
            String dispaly = engine.process(hostname, context);
            return dispaly;
        }
    }
}