[LineCTF2022]gotm ( golang SSTI + JWT伪造 )

[LineCTF2022]gotm

本文来自csdn的⭐️shu天⭐️，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_CSDN博客-ctf,取证,web领域博主：https://blog.csdn.net/weixin_46081055 看看ヾ(＠ ˘ω˘ ＠)ノ！！

给了源码，分析一下几个路由和对应的请求处理函数

注册功能

http.HandleFunc("/regist", regist_handler)

func regist_handler(w http.ResponseWriter, r *http.Request) {
   
    uid := r.FormValue("id")
    upw := r.FormValue("pw")

    if uid == "" || upw == "" {
   
        return
    }

    if get_account(uid).id != "" {
   
        w.WriteHeader(http.StatusForbidden)
        return
    }
    if len(acc) > 4 {
   
        clear_account()
    }
    new_acc := Account{
   uid, upw, false, secret_key} //根据get传入的id和pw创建新的用户
    acc = append(acc, new_acc)

    p := Resp{
   true, ""}
    res