Overview
The page is a word-search form that finds words in a dictionary. Click “View sourcecode” to understand what happens when you submit a search.
Hints
Hint 1 — What shell command runs your input?
Hint 1 — What shell command runs your input?
Read the source. Your search term (There is no sanitization. What does this mean for the characters you can send?
$key) is inserted directly into a passthru() call:Hint 2 — Shell command chaining
Hint 2 — Shell command chaining
In bash,
&& runs a second command only if the first succeeds, and ; runs a second command unconditionally. If you inject && followed by another command into $key, the shell will execute both. Think about what command would let you read /etc/natas_webpass/natas10.Solution
Full walkthrough
Full walkthrough
1
Understand the injection point
The command the server runs is:Your input is placed directly into the command string with no escaping.
2
Craft the payload
Inject a second command after a valid The resulting shell command becomes:
grep argument:3
Submit and read the output
Enter the payload in the search box and click Search. The output shows
grep results first, followed by the contents of the password file.Never pass user input to
passthru(), exec(), system(), or shell_exec(). Use escapeshellarg() to safely quote individual arguments, or avoid shelling out entirely and use native PHP functions instead.