Over the wire Natas Level 8

Over the wire Natas Level 8

Objective:

Get password for Level 9

Solution:

So here we get a input box that checks to see if it’s the right key to get the correct password

We can see if the source code that the input we give is compared to  a hardcoded string before it gives out the password

$encodedSecret = "3d3d516343746d4d6d6c315669563362";

function encodeSecret($secret) {

    return bin2hex(strrev(base64_encode($secret)));

so it takes our input, base64encodes it, reverses the string, then converts to HEX

so theoretically we if we take the hard coded secret and run it through that sequence backwards we should have the value needed to match.

I wrote a little python script to do the encoding for me

import base64

string = '3d3d516343746d4d6d6c315669563362'

print("The String is: ",string, "Length  is :", len(string))

unhex = bytes.fromhex(string).decode('utf-8')

print("Un hexed is: ",unhex, "Length is: ",len(unhex))

reversestring = unhex[::-1]

print("reversed is: ",reversestring,"Length is: ",len(reversestring))

base64string = base64.b64decode(reversestring).decode('utf-8')

print("decdoed is: ", base64string, "Lenght is: ", len(base64string))

Here is the output

The String is:  3d3d516343746d4d6d6c315669563362 Length  is : 32

Un hexed is:  ==QcCtmMml1ViV3b Length is:  16

reversed is:  b3ViV1lmMmtCcQ== Length is:  16

decdoed is:  oubWYf2kBq Lenght is:  10

Let’s try this oubWYf2kBq  as the as they key to get the next password

Access granted. The password for natas9 is W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl