In this post we’re going to be looking at Level 7 of the Natas wargame from Over The Wire.<\/p>\n
Upon logging in, we are presented with a page with two links. \u00a0Let’s view the page’s source first. \u00a0Upon doing this, we get a comment hint that the password for the next level is located in the file at\u00a0\/etc\/natas_webpass\/natas8. \u00a0We also see that the two links are links to the current page with a value assigned to the “page” variable. \u00a0The value is passed via the URL and GET style arguments, making it easy to edit. \u00a0If we go back and click on either link we can see some text on each page.<\/p>\n
This site navigation option of taking a page name as a variable has many positive sides from a web-programmer’s point of view. \u00a0However, let’s look at how it is implemented in this page. \u00a0The simplest thing to conclude would be a simple include($_GET[‘page’]); call. \u00a0This would, in the example of home and about, simply get files called home or about. \u00a0Let’s check this idea by requesting those URLs ourselves and checking they exist and match what we saw earlier on those pages. \u00a0We should find\u00a0http:\/\/natas7.natas.labs.overthewire.org\/home<\/a>\u00a0and\u00a0http:\/\/natas7.natas.labs.overthewire.org\/about<\/a>\u00a0both exist, and have our expected values. \u00a0Thus, let’s make the assumption we figured out how the include works. \u00a0How can we use this to get the password to the next level?<\/p>\n Since the include file is specified via the page variable, let’s think about what we can supply as the page variable to get the password to the next level. \u00a0As we saw in the comment hint, the password is stored in the file\u00a0\/etc\/natas_webpass\/natas8. \u00a0So, let’s try supplying that as the value of the page variable! \u00a0Requesting the page,\u00a0http:\/\/natas7.natas.labs.overthewire.org\/index.php?page=\/etc\/natas_webpass\/natas8<\/a>, we get a response with the password for level 8.<\/p>\n So what!? \u00a0So don’t blindly let users access files or provide absolute and full file locations! \u00a0Use some input sanitation! Start from the current directory (string concat “.\/”.$sanitizedUserInput). \u00a0Append file types! \u00a0There are various options at making this safer, but having un-sanitized user provided data act as absolute file paths on the server, is not a good idea.<\/p>\n","protected":false},"excerpt":{"rendered":" In this post we’re going to be looking at Level 7 of the Natas wargame from Over The Wire. What’s Going On? Upon logging in, we are presented with a page with two links. \u00a0Let’s view the page’s source first. … Continue reading Exploit<\/h2>\n
So What?<\/h2>\n