In this post, we’re going to be looking at Level 15 of the Natas wargame, hosted by Over The Wire.<\/p>\n
Upon logging in, we are presented with another form. \u00a0This one prompts us for a username, and provides a “check existence” button. \u00a0A quick test of the form with a random username, such as “asdf”, and an assumed valid one, such as “natas16”, gives us a page which tells us the first user doesn’t exist and that the second one does. \u00a0To get a better understanding from here, let’s follow the link to the source code, and take a look at the PHP.<\/p>\n
We can see that the PHP source starts out with a comment about the creation of a table in a database. \u00a0This table is called “users” and has two columns, “username” and “password”. Below this comment we see the main PHP section of the page. \u00a0This code checks that the “username” field of the HTTP request is set before continuing on. \u00a0If it is set, there is a connection established to the level15 database, and a query is constructed to look up entries which match the value submitted through the username field of the HTTP request. \u00a0Looking at how the query is constructed, we can see that it’s vulnerable to injection. \u00a0However, if we look through the rest of the code, we notice it’s slightly different than the previous level in that there is no line printing the password, nor printing the results of the query. So, how will we get the password to the next level?<\/p>\n
As we can see in the PHP code, there is no direct way to get the results of the query, or get the password. \u00a0Thus, we’re going to have to take an indirect approach. \u00a0So, how can we indirectly get information from the database?<\/p>\n
Well, if we were able to compare the password field of the user natas16 to various values, and do something different when the values match, we could somehow get information out. \u00a0Since we know we cannot print information, how about doing something like making the process sleep? \u00a0Unfortunately, MySQL doesn’t have a sleep function we can embed in a query, but let’s look at what it does have.<\/p>\n
Now let’s think about how to combine those things to figure out the length of the password. As we can see from the PHP code, the query is as follows:<\/p>\n
SELECT\u00a0*\u00a0from\u00a0users\u00a0where\u00a0username=”username”<\/p><\/blockquote>\n
So, let’s choose the natas16 user, then join on another select query for the password which, if the length of the password is 32, will run a long benchmark before returning:<\/p>\n
natas16″ UNION SELECT password, IF(LENGTH(password)=32,BENCHMARK(500000000,ENCODE(‘The Message’,’The Key’)),null) FROM users WHERE username=”natas16<\/p><\/blockquote>\n
When submitted, we can see that it takes a long time for the page to load (if it ever does). \u00a0If we change to length 31, the page loads immediately. \u00a0Thus, we have used this indirect path to gain information about what was in the table by using time as a pathway to transfer information. \u00a0Now that we know the password is 32 characters (like the previous passwords), let’s attempt to make another construction to test the values of the password.<\/p>\n
As stated above, we can use MySQL’s substring function to return part of a string. \u00a0So, let’s use this to select one character in the string and compare it’s value to a character we specify. \u00a0If they are equal, we’ll force a benchmark, otherwise we’ll see the resultant page immediate.<\/p>\n
natas16″ UNION SELECT password, IF(SUBSTRING(password,1,1) = BINARY(CHAR(50)),BENCHMARK(600000000,ENCODE(‘The Message’,’The Key’)),null) FROM users WHERE username=”natas16<\/p><\/blockquote>\n
One thing to specify about the above code is the use of binary(char(50)). \u00a0Char(50) specifies the character with ascii decimal code 50. \u00a0However, when MySQL compares strings (or characters), it does so without regard to case. \u00a0Thus, not including the binary() call, this query would run the benchmark for both char(97) and char(65) (a or A). \u00a0The use of binary(char()) forces case-sensitivity.<\/p>\n
Now that we know how the above code works, we can submit it for every ASCII value we’d expect could be in the password as the input into the char() function, until we reach a value which forces the page to not return quickly (aka forces the benchmark to run). \u00a0Once this happens, we know we’ve found the ASCII value of the 1st character of the password. \u00a0For example, if we increase 50 to 51 and submit the query, we find out the page doesn’t load and thus, the first character of the password is ASCII 51, also known as the number 3.<\/p>\n
Once we’ve found the 1st character, we can change the substring call from\u00a0SUBSTRING(password,1,1) to\u00a0SUBSTRING(password,2,1) and start all over again brute forcing char values at 48. \u00a0Once the 2nd character is found, restart with the 3rd, repeat until finished.<\/p>\n
Now I hear you saying, “But that sounds boring and like it will take a long time!” \u00a0Yeah, well, write a script to do it. \u00a0Computers are great at\u00a0repetitive tasks. \u00a0In fact, a PHP script to figure out the entire password isn’t too hard to write and is what I used for this challenge. \u00a0Expect a script post here in the future.<\/p>\n
So What?<\/h2>\n
Even when results of a query are not displayed on the page, or directly used to display sensitive information, results are still transferred to users. \u00a0Results are a relative term, and with injection a result can be the delayed processing of a page, such as in this example. \u00a0More strenuous actions need to be taken to prevent injection in the first place, because as this level shows, even blind injection can be used to get the exact values in a database, such as a 32 character long password in under an hour (or faster in production web environments which will allow more connections at a time and thus, less throttling for a script).<\/p>\n","protected":false},"excerpt":{"rendered":"
In this post, we’re going to be looking at Level 15 of the Natas wargame, hosted by Over The Wire. What’s Going On? Upon logging in, we are presented with another form. \u00a0This one prompts us for a username, and … Continue reading