Natas Wargame Writeup (Levels 11-20)

Introduction

This blog post contains the writeup for the natas wargame levels 11 to 20. If you haven’t already, I recommend reading the previous articles on the introduction and the writeup on Levels 0-10.

Level 11

URL: http://natas11.natas.labs.overthewire.org

Credentials: natas11:1KFqoJXi6hRaPluAmk8ESDW4fSysRoIg

Code

        
      
<?

$defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff");

function xor_encrypt($in) {
    $key = '<censored>';
    $text = $in;
    $outText = '';

    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }

    return $outText;
}

function loadData($def) {
    global $_COOKIE;
    $mydata = $def;
    if(array_key_exists("data", $_COOKIE)) {
    $tempdata = json_decode(xor_encrypt(base64_decode($_COOKIE["data"])), true);
    if(is_array($tempdata) && array_key_exists("showpassword", $tempdata) && array_key_exists("bgcolor", $tempdata)) {
        if (preg_match('/^#(?:[a-f\d]{6})$/i', $tempdata['bgcolor'])) {
        $mydata['showpassword'] = $tempdata['showpassword'];
        $mydata['bgcolor'] = $tempdata['bgcolor'];
        }
    }
    }
    return $mydata;
}

function saveData($d) {
    setcookie("data", base64_encode(xor_encrypt(json_encode($d))));
}

$data = loadData($defaultdata);

if(array_key_exists("bgcolor",$_REQUEST)) {
    if (preg_match('/^#(?:[a-f\d]{6})$/i', $_REQUEST['bgcolor'])) {
        $data['bgcolor'] = $_REQUEST['bgcolor'];
    }
}

saveData($data);



?>

<h1>natas11</h1>
<div id="content">
<body style="background: <?=$data['bgcolor']?>;">
Cookies are protected with XOR encryption<br/><br/>

<?
if($data["showpassword"] == "yes") {
    print "The password for natas12 is <censored><br>";
}

?>

<form>
Background color: <input name=bgcolor value="<?=$data['bgcolor']?>">
<input type=submit value="Set color">
</form>

Solution

Upon inspecting the source code, I saw that Level 11 involved XOR encryption. The method I used to tackle this was to reverse engineer the encryption to find the key used in the encryption, then once the key was obtained, I reencrypted the edited plaintext with the value of show password being yes. A problem that I came across was in using multiple programs to encode the edited plaintext. This was due to invisible characters failing to be displayed, which resulted in error.

Fix

The solution to this would be to hide the plaintext in a separate secure file which would disable this method. Alternatively, it would be possible to use generate a completely random string and store it in an external file, making it virtually impossible for the attacker to gain another code.

Password: YWqo0pjpcXzSIl5NMAVxg12QxeC1w9QG

Level 12

URL: http://natas12.natas.labs.overthewire.org

Credentials: natas12:YWqo0pjpcXzSIl5NMAVxg12QxeC1w9QG

Code

        
      
<?php

function genRandomString() {
    $length = 10;
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
    $string = "";

    for ($p = 0; $p < $length; $p++) {
        $string .= $characters[mt_rand(0, strlen($characters)-1)];
    }

    return $string;
}

function makeRandomPath($dir, $ext) {
    do {
    $path = $dir."/".genRandomString().".".$ext;
    } while(file_exists($path));
    return $path;
}

function makeRandomPathFromFilename($dir, $fn) {
    $ext = pathinfo($fn, PATHINFO_EXTENSION);
    return makeRandomPath($dir, $ext);
}

if(array_key_exists("filename", $_POST)) {
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);


        if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {
        echo "File is too big";
    } else {
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
        } else{
            echo "There was an error uploading the file, please try again!";
        }
    }
} else {
?>

<form enctype="multipart/form-data" action="index.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="1000" />
<input type="hidden" name="filename" value="<?php print genRandomString(); ?>.jpg" />
Choose a JPEG to upload (max 1KB):<br/>
<input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload File" />
</form>
<?php } ?>

Solution

Level 12 was composed of a file uploader which asked for images to be uploaded, then it would store the file in its directory. To pass this level, I intercepted the request transmitted using Burp Suite, then I changed the contents of the jpeg to a webshell which would allow me to execute commands. I also changed the file type to php, so that it would be compatible with the webshell. Upon forwarding, I changed the URL to from /index.php to /index.php?cmd=cat/etc/natas_webpass/natas13. This line concatenated the contents of the file, which was the password.

Fix

The fix for vulnerabilities with uploading files would be to check the file type against whitelisted file extensions, and have a proper validation system. It would also help to ensure that all contents were converted to plaintext.

Password: lW3jYRI02ZKDBb8VtQBU1f6eDRo6WEj9

Level 13

URL: http://natas13.natas.labs.overthewire.org

Credentials: natas13:lW3jYRI02ZKDBb8VtQBU1f6eDRo6WEj9

Code

        
      
<?php

function genRandomString() {
    $length = 10;
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
    $string = "";

    for ($p = 0; $p < $length; $p++) {
        $string .= $characters[mt_rand(0, strlen($characters)-1)];
    }

    return $string;
}

function makeRandomPath($dir, $ext) {
    do {
    $path = $dir."/".genRandomString().".".$ext;
    } while(file_exists($path));
    return $path;
}

function makeRandomPathFromFilename($dir, $fn) {
    $ext = pathinfo($fn, PATHINFO_EXTENSION);
    return makeRandomPath($dir, $ext);
}

if(array_key_exists("filename", $_POST)) {
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);

    $err=$_FILES['uploadedfile']['error'];
    if($err){
        if($err === 2){
            echo "The uploaded file exceeds MAX_FILE_SIZE";
        } else{
            echo "Something went wrong :/";
        }
    } else if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {
        echo "File is too big";
    } else if (! exif_imagetype($_FILES['uploadedfile']['tmp_name'])) {
        echo "File is not an image";
    } else {
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
        } else{
            echo "There was an error uploading the file, please try again!";
        }
    }
} else {
?>

<form enctype="multipart/form-data" action="index.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="1000" />
<input type="hidden" name="filename" value="<?php print genRandomString(); ?>.jpg" />
Choose a JPEG to upload (max 1KB):<br/>
<input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload File" />
</form>
<?php } ?>

Solution

This stage was almost identical to the previous stage, except it utilized ‘exif_imagetype’ to ensure the file uploaded was an image. Initially, I attempted to bypass it by using terminal to hide a php file within a jpeg, however it was too large as the program now only accepted files smaller than 1KB. Following this, I instead inserted the line GIF89a in the initial area of the code. What this did was that it tricked the program into thinking it was a gif file, which is a subcategory of images, which passed the exif_imagetype check. From here, I created the webshell as before using (replace %3F with ?), and edited the url as before which gave me the password.

Fix

The fix for this vulnerability is the same as the previous issue - check the type of file against whitelisted file extensions, and have a proper validation system, also possibly converting file contents to plaintext.

Password: qPazSJBmrmU7UQJv17MHk1PGC4DxZMEP

Level 14

URL: http://natas14.natas.labs.overthewire.org

Credentials: natas14:qPazSJBmrmU7UQJv17MHk1PGC4DxZMEP

Code

        
      
<html>
<head>
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas14", "pass": "<censored>" };</script></head>
<body>
<h1>natas14</h1>
<div id="content">
<?php
if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas14', '<censored>');
    mysqli_select_db($link, 'natas14');

    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\" and password=\"".$_REQUEST["password"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    if(mysqli_num_rows(mysqli_query($link, $query)) > 0) {
            echo "Successful login! The password for natas15 is <censored><br>";
    } else {
            echo "Access denied!<br>";
    }
    mysqli_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

Level 14 looks relatively simple - a $_POST request indicating the entry of a username and password into the form. Since guessing the password and username would be almost impossible and brute forcing was not an option, I therefore used an SQL injection as I found that there was usage of mysql in the source code. I wrote ‘’ or “”=“ in place of the password, which meant that the statement provided guaranteed a return true, manipulating the code into thinking that the correct username and password was entered, thus it showed the password.

Fix

The solution to prevent sequel injections would be to stop writing dynamic queries with string concatenation and/or prevent user supplied input containing malicious SQL from affecting the logic of the query.

Password: TTkaI7AWG4iDERztBcEyKV7kRXH1EZRB

Level 15

URL: http://natas15.natas.labs.overthewire.org

Credentials: natas15:TTkaI7AWG4iDERztBcEyKV7kRXH1EZRB

Code

        
      
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas15", "pass": "<censored>" };</script></head>
<body>
<h1>natas15</h1>
<div id="content">
<?php

/*
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
*/

if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas15', '<censored>');
    mysqli_select_db($link, 'natas15');

    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    $res = mysqli_query($link, $query);
    if($res) {
    if(mysqli_num_rows($res) > 0) {
        echo "This user exists.<br>";
    } else {
        echo "This user doesn't exist.<br>";
    }
    } else {
        echo "Error in query.<br>";
    }

    mysqli_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
<input type="submit" value="Check existence" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

This level only had a username box, and it only verified if the user existed. Upon inspecting the code, it could be noted that there was a vulnerability to Blind SQL injection, where I would have to add another condition such as ‘1=1’ to create a true false statement regarding the password. http://natas15.natas.labs.overthewire.org/index.php?username=natas16%22%20and%20ord(mid(password,1,1))%3E97%20and%20%221%22=%221 This line shows how it would be done to check the 1st char of the password. The data tables were shown in the source code, and the username was already known.

Fix

The fix for a vulnerability to blind sql injection would be to use parametrized queries that would ensure that the user would be unable to interfere with the SQL query.

Password: TRD7iZrd5gATjj9PkPEuaOlfEjHqj32V

Level 16

URL: http://natas16.natas.labs.overthewire.org

Credentials: natas16:TRD7iZrd5gATjj9PkPEuaOlfEjHqj32V

Code

        
      
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas16", "pass": "<censored>" };</script></head>
<body>
<h1>natas16</h1>
<div id="content">

For security reasons, we now filter even more on certain characters<br/><br/>
<form>
Find words containing: <input name=needle><input type=submit name=submit value=Search><br><br>
</form>


Output:
<pre>
<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    if(preg_match('/[;|&`\'"]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i \"$key\" dictionary.txt");
    }
}
?>
</pre>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

This level bore resemblance to level 10, however the difference was that it had filtered out the double quotes as well as everything else. This was a problem because it forced a different solution. To get to the password, I utilized the grep function in the url of the page. by inserting KEYWORD$(grep char /etc/natas_webpass/natas17), I was able to determine which characters were in the password by running a line of code which returned the character and concatenated it to a string when the keyword didn’t appear. To find out what order they were in, I used the ^ in front of the char string. By doing this with the list of filtered out characters, I was able to determine what character started the password and which ones succeeded it.

Fix

The fix for this vulnerability would be to incorporate a whitelist that only allows the input and returns characters, which disables the usage of characters such as () or / which are essential in this attack.

Password: XkEuChE0SbnKBvH1RU7ksIb9uuLmI7sd

Level 17

URL: http://natas 17.natas.labs.overthewire.org

Credentials: natas17:XkEuChE0SbnKBvH1RU7ksIb9uuLmI7sd

Code

        
      
<html>
<head>
<body>
<h1>natas17</h1>
<div id="content">
<?php

/*
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
*/

if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas17', '<censored>');
    mysqli_select_db($link, 'natas17');

    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    $res = mysqli_query($link, $query);
    if($res) {
    if(mysqli_num_rows($res) > 0) {
        //echo "This user exists.<br>";
    } else {
        //echo "This user doesn't exist.<br>";
    }
    } else {
        //echo "Error in query.<br>";
    }

    mysqli_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
<input type="submit" value="Check existence" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

In this level, it was clear that the level had SQL vulnerabilities because of the page’s usage of mysql. Looking at the code, there was nothing that would support boolean based blind sql injection, so I resorted to a time based sql injection method by using SQLmap. Then method worked by inserting the time delay condition which would be activated and noticed if the other condition was fulfilled, which was if the characters were in the password. It required me to provide authentication and table information to the sqlmap, and it did the rest of the work, giving me the password. SQLMap simply performs sql injections automatically at mechanical precision, which make it a lot more time saving especially for time based SQL injections.

Fix

Password: 8NEDUUxg8kFgPV84uLwvZkGn6okJQ6aq

Level 18

URL: http://natas18.natas.labs.overthewire.org

Credentials: natas18:8NEDUUxg8kFgPV84uLwvZkGn6okJQ6aq

Code

        
      
<html>
<body>
<h1>natas18</h1>
<div id="content">
<?php

$maxid = 640; // 640 should be enough for everyone

function isValidAdminLogin() { 
    if($_REQUEST["username"] == "admin") {
    /* This method of authentication appears to be unsafe and has been disabled for now. */
        //return 1;
    }

    return 0;
}

function isValidID($id) { 
    return is_numeric($id);
}

function createID($user) { 
    global $maxid;
    return rand(1, $maxid);
}

function debug($msg) { 
    if(array_key_exists("debug", $_GET)) {
        print "DEBUG: $msg<br>";
    }
}

function my_session_start() { 
    if(array_key_exists("PHPSESSID", $_COOKIE) and isValidID($_COOKIE["PHPSESSID"])) {
    if(!session_start()) {
        debug("Session start failed");
        return false;
    } else {
        debug("Session start ok");
        if(!array_key_exists("admin", $_SESSION)) {
        debug("Session was old: admin flag set");
        $_SESSION["admin"] = 0; // backwards compatible, secure
        }
        return true;
    }
    }

    return false;
}

function print_credentials() { 
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas19\n";
    print "Password: <censored></pre>";
    } else {
    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas19.";
    }
}


$showform = true;
if(my_session_start()) {
    print_credentials();
    $showform = false;
} else {
    if(array_key_exists("username", $_REQUEST) && array_key_exists("password", $_REQUEST)) {
    session_id(createID($_REQUEST["username"]));
    session_start();
    $_SESSION["admin"] = isValidAdminLogin();
    debug("New session started");
    $showform = false;
    print_credentials();
    }
}

if($showform) {
?>

<p>
Please login with your admin account to retrieve credentials for natas19.
</p>

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

This level required cookie manipulation. It would be known that the user would be admin and the password was unknown, however by using Burp Suite and running through the first 640 possible cookie ids (640 was the maximum id of a cookie), I found one irregularity and replaced my cookie with that id and was given the password.

Fix

The solution for this would be to use a randomly generated encryption method in place of the cookie and store the data in a secure file to ensure that it would be near impossible to recreate the cookie. The cookie should also be signed to prevent client sided cookie manipulation improving the server security and decreasing the risk of a cookie hijacking attack.

Password: 8LMJEhKFbMKIL2mxQKjv0aEDdk7zpT0s

Level 19

URL: http://natas19.natas.labs.overthewire.org

Click me for the Level Credentials!

Credentials: `natas19:8LMJEhKFbMKIL2mxQKjv0aEDdk7zpT0s`

Code

        
      
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas19", "pass": "<censored>" };</script></head>
<body>
<h1>natas19</h1>
<div id="content">
<p>
<b>
This page uses mostly the same code as the previous level, but session IDs are no longer sequential...
</b>
</p>
<?php

$maxid = 640; // 640 should be enough for everyone

function myhex2bin($h) { 
  if (!is_string($h)) return null;
  $r='';
  for ($a=0; $a<strlen($h); $a+=2) { $r.=chr(hexdec($h[$a].$h[($a+1)])); }
  return $r;
}

function isValidAdminLogin() { 
    if($_REQUEST["username"] == "admin") {
    /* This method of authentication appears to be unsafe and has been disabled for now. */
        //return 1;
    }

    return 0;
}

function isValidID($id) { 
    // must be lowercase
    if($id != strtolower($id)) {
        return false;
    }

    // must decode
    $decoded = myhex2bin($id);

    // must contain a number and a username
    if(preg_match('/^(?P<id>\d+)-(?P<name>\w+)$/', $decoded, $matches)) {
        return true;
    }

    return false;
}

function createID($user) { 
    global $maxid;
    $idnum = rand(1, $maxid);
    $idstr = "$idnum-$user";
    return bin2hex($idstr);
}

function debug($msg) { 
    if(array_key_exists("debug", $_GET)) {
        print "DEBUG: $msg<br>";
    }
}

function my_session_start() { 
    if(array_key_exists("PHPSESSID", $_COOKIE) and isValidID($_COOKIE["PHPSESSID"])) {
    if(!session_start()) {
        debug("Session start failed");
        return false;
    } else {
        debug("Session start ok");
        if(!array_key_exists("admin", $_SESSION)) {
        debug("Session was old: admin flag set");
        $_SESSION["admin"] = 0; // backwards compatible, secure
        }
        return true;
    }
    }

    return false;
}

function print_credentials() { 
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas20\n";
    print "Password: <censored></pre>";
    } else {
    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas20.";
    }
}


$showform = true;
if(my_session_start()) {
    print_credentials();
    $showform = false;
} else {
    if(array_key_exists("username", $_REQUEST) && array_key_exists("password", $_REQUEST)) {
    session_id(createID($_REQUEST["username"]));
    session_start();
    $_SESSION["admin"] = isValidAdminLogin();
    debug("New session started");
    $showform = false;
    print_credentials();
    }
}

if($showform) {
?>

<p>
Please login with your admin account to retrieve credentials for natas20.
</p>

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
</form>
<?php } ?>
</div>
</body>
</html>

Solution

Level 19 was the same as level 18, however this time the session codes were formatted differently. I could see that it was hex code, and after entering the username, I found that the format was [ID-USERNAME]. Having found this out, I ran a script that converted numbers 1-640 to hex code and appended ‘2d61646d696ea’ to the end of the encoded values and ran a sniper attack cycling through the payloads until I was returned the password.

Fix

The quick solution for this would be to sign each individual cookie to ensure that the attacker cannot change the cookie id and conduct an attack because signing a cookie detects if the cookie has been tampered with.

Password: guVaZ3ET35LbgbFMoaN5tFcYT1jEP7UH

Level 20

URL: http://natas20.natas.labs.overthewire.org

Credentials: natas20:guVaZ3ET35LbgbFMoaN5tFcYT1jEP7UH

Code

        
      
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas20", "pass": "<censored>" };</script></head>
<body>
<h1>natas20</h1>
<div id="content">
<?php

function debug($msg) { 
    if(array_key_exists("debug", $_GET)) {
        print "DEBUG: $msg<br>";
    }
}

function print_credentials() { 
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas21\n";
    print "Password: <censored></pre>";
    } else {
    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas21.";
    }
}


/* we don't need this */
function myopen($path, $name) {
    //debug("MYOPEN $path $name");
    return true;
}

/* we don't need this */
function myclose() {
    //debug("MYCLOSE");
    return true;
}

function myread($sid) {
    debug("MYREAD $sid");
    if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) {
    debug("Invalid SID");
        return "";
    }
    $filename = session_save_path() . "/" . "mysess_" . $sid;
    if(!file_exists($filename)) {
        debug("Session file doesn't exist");
        return "";
    }
    debug("Reading from ". $filename);
    $data = file_get_contents($filename);
    $_SESSION = array();
    foreach(explode("\n", $data) as $line) {
        debug("Read [$line]");
    $parts = explode(" ", $line, 2);
    if($parts[0] != "") $_SESSION[$parts[0]] = $parts[1];
    }
    return session_encode();
}

function mywrite($sid, $data) {
    // $data contains the serialized version of $_SESSION
    // but our encoding is better
    debug("MYWRITE $sid $data");
    // make sure the sid is alnum only!!
    if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) {
    debug("Invalid SID");
        return;
    }
    $filename = session_save_path() . "/" . "mysess_" . $sid;
    $data = "";
    debug("Saving in ". $filename);
    ksort($_SESSION);
    foreach($_SESSION as $key => $value) {
        debug("$key => $value");
        $data .= "$key $value\n";
    }
    file_put_contents($filename, $data);
    chmod($filename, 0600);
}

/* we don't need this */
function mydestroy($sid) {
    //debug("MYDESTROY $sid");
    return true;
}
/* we don't need this */
function mygarbage($t) {
    //debug("MYGARBAGE $t");
    return true;
}

session_set_save_handler(
    "myopen",
    "myclose",
    "myread",
    "mywrite",
    "mydestroy",
    "mygarbage");
session_start();

if(array_key_exists("name", $_REQUEST)) {
    $_SESSION["name"] = $_REQUEST["name"];
    debug("Name set to " . $_REQUEST["name"]);
}

print_credentials();

$name = "";
if(array_key_exists("name", $_SESSION)) {
    $name = $_SESSION["name"];
}

?>

<form action="index.php" method="POST">
Your name: <input name="name" value="<?=$name?>"><br>
<input type="submit" value="Change name" />
</form>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

Solution

Level 20 contained of a password box asking for a name. Looking at the source code, I could see that the conditions needed for the password to be revealed was that the session had to contain the string ‘admin’ and the value admin had to be set as 1. To do this, I ran a python script that, after authenticating its connection to the server, it would submit ‘name=admin\nadmin 1’. What this did was that it set the name to admin and the ‘\n’ caused a line break, saving the string ‘admin 1’ on the following line. The reason that it was written as ‘admin 1’ and not admin=1 is because of how the file would store the session data.

Fix

The solution for this would be to only save the first line of input and use readline(1) to only account for the first line and ignore the rest of the response provided by the user.

Password: 89OWrTkGmiLZLv12JY4tLj2c4FW0xn56

What’s Next?

If you are interested in reading about the next 5 levels, click here.

Natas Wargame Writeup (Levels 11-20)

Introduction

Level 11

URL: http://natas11.natas.labs.overthewire.org

Code

Solution

Fix

Level 12

URL: http://natas12.natas.labs.overthewire.org

Code

Solution

Fix

Level 13

URL: http://natas13.natas.labs.overthewire.org

Code

Solution

Fix

Level 14

URL: http://natas14.natas.labs.overthewire.org

Code

Solution

Fix

Level 15

URL: http://natas15.natas.labs.overthewire.org

Code

Solution

Fix

Level 16

URL: http://natas16.natas.labs.overthewire.org

Code

Solution

Fix

Level 17

URL: http://natas 17.natas.labs.overthewire.org

Code

Solution

Fix

Level 18

URL: http://natas18.natas.labs.overthewire.org

Code

Solution

Fix

Level 19

URL: http://natas19.natas.labs.overthewire.org

Code

Solution

Fix

Level 20

URL: http://natas20.natas.labs.overthewire.org

Code

Solution

Fix

What’s Next?

Further Reading

Natas Wargame Writeup (Levels 21-25)

Natas Wargame Writeup (Levels 0-10)

OWASP Research Page