https://dev-initely.me/natas/Recent content in Natas on Coding braindumpHugoenWed, 02 Apr 2025 22:58:00 +0700https://dev-initely.me/natas/level16/Thu, 27 Mar 2025 00:00:00 +0700https://dev-initely.me/natas/level16/<ul> <li>State &ldquo;DONE&rdquo; from &ldquo;TODO&rdquo; <span class="timestamp-wrapper"><span class="timestamp">[2025-04-02 Wed 22:58]</span></span></li> </ul> <p><a href="http://natas16.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas16.natas.labs.overthewire.org/</a> </p> <p>So there is one input field and a comment that for security reasons, the code now filters on more characters. There is also a output field below, supposedly to give back a response from the search request.</p> <p>Alright, let&rsquo;s look at the sourcecode:</p> <div class="code-block code-line-numbers open" style="counter-reset: code-block 0"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas16&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas16&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; For security reasons, we now filter even more on certain characters&lt;br/&gt;&lt;br/&gt; &lt;form&gt; Find words containing: &lt;input name=needle&gt;&lt;input type=submit name=submit value=Search&gt;&lt;br&gt;&lt;br&gt; &lt;/form&gt; Output: &lt;pre&gt; &lt;? $key = &#34;&#34;; if(array_key_exists(&#34;needle&#34;, $_REQUEST)) { $key = $_REQUEST[&#34;needle&#34;]; } if($key != &#34;&#34;) { if(preg_match(&#39;/[;|&amp;`\&#39;&#34;]/&#39;,$key)) { print &#34;Input contains an illegal character!&#34;; } else { passthru(&#34;grep -i \&#34;$key\&#34; dictionary.txt&#34;); } } ?&gt; &lt;/pre&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <h2 id="shell-injection">Shell injection</h2> <p>At first impression, this looks very much like level 9 above; if you need a reminder, go look at the walkthrough for it. We made use of the fact that passthru() does not sanitize and where able to insert some shell code into the grep command like so <code>test; whoami</code>.</p>https://dev-initely.me/natas/level1/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level1/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p>You can find the password for the next level on this page, but rightclicking has been blocked!</p> <p>And indeed: we try to rightclick and get an annoying error message. However, a quick google search shows us that there is a shortcut for Chrome: <code>CTRL + U</code> gets us the page source</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-html"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">html</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="c">&lt;!-- This stuff in the header has nothing to do with the level --&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">type</span><span class="o">=</span><span class="s">&#34;text/css&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/level.css&#34;</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34;</span> <span class="p">/&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/wechall.css&#34;</span> <span class="p">/&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">http://natas.labs.overthewire.org/js/wechall-data.js</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span><span class="p">&gt;</span><span class="kd">var</span> <span class="nx">wechallinfo</span> <span class="o">=</span> <span class="p">{</span> <span class="s2">&#34;level&#34;</span><span class="o">:</span> <span class="s2">&#34;natas1&#34;</span><span class="p">,</span> <span class="s2">&#34;pass&#34;</span><span class="o">:</span> <span class="s2">&#34;0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq&#34;</span> <span class="p">};&lt;/</span><span class="nt">script</span><span class="p">&gt;&lt;/</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">body</span> <span class="na">oncontextmenu</span><span class="o">=</span><span class="s">&#34;javascript:alert(&#39;right clicking has been blocked!&#39;);return false;&#34;</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">h1</span><span class="p">&gt;</span>natas1<span class="p">&lt;/</span><span class="nt">h1</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">div</span> <span class="na">id</span><span class="o">=</span><span class="s">&#34;content&#34;</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> You can find the password for the </span></span><span class="line"><span class="cl"> next level on this page, but rightclicking has been blocked! </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c">&lt;!--The password for natas2 is TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI --&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;/</span><span class="nt">div</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;/</span><span class="nt">body</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;/</span><span class="nt">html</span><span class="p">&gt;</span></span></span></code></pre></div></div> <ul> <li>TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI</li> </ul>https://dev-initely.me/natas/level10/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level10/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas10.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas10.natas.labs.overthewire.org/</a> </p> <p>Level 10 starts off the same way as level 9, however it seems that now there is a filter against certain characters. <img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="clipboard-20250227T233639.png" data-srcset="clipboard-20250227T233639.png, clipboard-20250227T233639.png 1.5x, clipboard-20250227T233639.png 2x" data-sizes="auto" alt="clipboard-20250227T233639.png" title="clipboard-20250227T233639.png" /></p> <p>Looking at the sourcecode, we see that the characters <code>;|&amp;</code> are now disallowed. However, space is not disallowed.</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;? $key = &#34;&#34;; if(array_key_exists(&#34;needle&#34;, $_REQUEST)) { $key = $_REQUEST[&#34;needle&#34;]; } if($key != &#34;&#34;) { if(preg_match(&#39;/[;|&amp;]/&#39;,$key)) { print &#34;Input contains an illegal character!&#34;; } else { passthru(&#34;grep -i $key dictionary.txt&#34;); } } ?&gt;</code></pre></div> <p>So the strategy from level 9 will not work anymore. However, there is another way to exploit this - we can use the fact that <code>grep</code> can search through several files.</p>https://dev-initely.me/natas/level11/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level11/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas11.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas11.natas.labs.overthewire.org/</a> </p> <p>This level seems to work with an encryption called XOR encryption:</p> <figure><img src="clipboard-20250301T221818.png"> </figure> <h2 id="background">Background</h2> <p>Okay, some theory first: what is an XOR cipher? It is a type of additive cipher that works with the applying the bitwise XOR operator to every character using a given key. To decrypt, applying the XOR function with the key will remove the cipher. To take an example from Wikipedia, let&rsquo;s take the string &lsquo;Wiki&rsquo; and encode it in 8-bit ASCII and encode it with the key 11110011:</p>https://dev-initely.me/natas/level12/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level12/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas12.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas12.natas.labs.overthewire.org/</a> </p> <p>This one took me quite a while to figure out using several tutorials from different websites. First we see an upload dialogue allowing us to upload a JPEG file.</p> <figure><img src="clipboard-20250310T165111.png"> </figure> <h2 id="background">Background</h2> <p>If a webpage allows to upload files, the developer has to make sure that the backend checks appropriately for filetypes and malicious intent. So here I assume that no proper checking is done and we can do something malicious.</p>https://dev-initely.me/natas/level13/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level13/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas13.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas13.natas.labs.overthewire.org/</a> </p> <figure><img src="clipboard-20250316T214024.png"> </figure> <p>This one looks very similar to the prior exercise, so let&rsquo;s start the same way and look at the source code.</p> <div class="code-block" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas13&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas13&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; For security reasons, we now only accept image files!&lt;br/&gt;&lt;br/&gt; &lt;?php function genRandomString() { $length = 10; $characters = &#34;0123456789abcdefghijklmnopqrstuvwxyz&#34;; $string = &#34;&#34;; for ($p = 0; $p &lt; $length; $p++) { $string .= $characters[mt_rand(0, strlen($characters)-1)]; } return $string; } function makeRandomPath($dir, $ext) { do { $path = $dir.&#34;/&#34;.genRandomString().&#34;.&#34;.$ext; } while(file_exists($path)); return $path; } function makeRandomPathFromFilename($dir, $fn) { $ext = pathinfo($fn, PATHINFO_EXTENSION); return makeRandomPath($dir, $ext); } if(array_key_exists(&#34;filename&#34;, $_POST)) { $target_path = makeRandomPathFromFilename(&#34;upload&#34;, $_POST[&#34;filename&#34;]); $err=$_FILES[&#39;uploadedfile&#39;][&#39;error&#39;]; if($err){ if($err === 2){ echo &#34;The uploaded file exceeds MAX_FILE_SIZE&#34;; } else{ echo &#34;Something went wrong :/&#34;; } } else if(filesize($_FILES[&#39;uploadedfile&#39;][&#39;tmp_name&#39;]) &gt; 1000) { echo &#34;File is too big&#34;; } else if (! exif_imagetype($_FILES[&#39;uploadedfile&#39;][&#39;tmp_name&#39;])) { echo &#34;File is not an image&#34;; } else { if(move_uploaded_file($_FILES[&#39;uploadedfile&#39;][&#39;tmp_name&#39;], $target_path)) { echo &#34;The file &lt;a href=\&#34;$target_path\&#34;&gt;$target_path&lt;/a&gt; has been uploaded&#34;; } else{ echo &#34;There was an error uploading the file, please try again!&#34;; } } } else { ?&gt; &lt;form enctype=&#34;multipart/form-data&#34; action=&#34;index.php&#34; method=&#34;POST&#34;&gt; &lt;input type=&#34;hidden&#34; name=&#34;MAX_FILE_SIZE&#34; value=&#34;1000&#34; /&gt; &lt;input type=&#34;hidden&#34; name=&#34;filename&#34; value=&#34;&lt;?php print genRandomString(); ?&gt;.jpg&#34; /&gt; Choose a JPEG to upload (max 1KB):&lt;br/&gt; &lt;input name=&#34;uploadedfile&#34; type=&#34;file&#34; /&gt;&lt;br /&gt; &lt;input type=&#34;submit&#34; value=&#34;Upload File&#34; /&gt; &lt;/form&gt; &lt;?php } ?&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>The code introduces some additional file checking, specifically here:</p>https://dev-initely.me/natas/level14/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level14/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas14.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas14.natas.labs.overthewire.org/</a> </p> <p>Level 14 starts with a common username and passwword login form: <img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="clipboard-20250317T101510.png" data-srcset="clipboard-20250317T101510.png, clipboard-20250317T101510.png 1.5x, clipboard-20250317T101510.png 2x" data-sizes="auto" alt="clipboard-20250317T101510.png" title="clipboard-20250317T101510.png" /></p> <p>Trying a random value yields a simple message: &ldquo;Access denied&rdquo;. So have a look at the sourcecode:</p> <div class="code-block code-line-numbers open" style="counter-reset: code-block 0"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web"> &lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas14&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas14&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; &lt;?php if(array_key_exists(&#34;username&#34;, $_REQUEST)) { $link = mysqli_connect(&#39;localhost&#39;, &#39;natas14&#39;, &#39;&lt;censored&gt;&#39;); mysqli_select_db($link, &#39;natas14&#39;); $query = &#34;SELECT * from users where username=\&#34;&#34;.$_REQUEST[&#34;username&#34;].&#34;\&#34; and password=\&#34;&#34;.$_REQUEST[&#34;password&#34;].&#34;\&#34;&#34;; if(array_key_exists(&#34;debug&#34;, $_GET)) { echo &#34;Executing query: $query&lt;br&gt;&#34;; } if(mysqli_num_rows(mysqli_query($link, $query)) &gt; 0) { echo &#34;Successful login! The password for natas15 is &lt;censored&gt;&lt;br&gt;&#34;; } else { echo &#34;Access denied!&lt;br&gt;&#34;; } mysqli_close($link); } else { ?&gt; &lt;form action=&#34;index.php&#34; method=&#34;POST&#34;&gt; Username: &lt;input name=&#34;username&#34;&gt;&lt;br&gt; Password: &lt;input name=&#34;password&#34;&gt;&lt;br&gt; &lt;input type=&#34;submit&#34; value=&#34;Login&#34; /&gt; &lt;/form&gt; &lt;?php } ?&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>The code first checks if a username is provided, then establishes a connection to MySQL using the username <code>natas14</code> and selects the natas14 database. Then it constructs the SQL query with the input from the input form. The script then runs the SQL query and checks if any rows match the username and password. Finally, it closes the connection.</p>https://dev-initely.me/natas/level15/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level15/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas15.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas15.natas.labs.overthewire.org/</a> </p> <p>This level starts very similar to level 14, however no we only check for the existence of a user using an input field:</p> <figure><img src="clipboard-20250319T130841.png"> </figure> <p>Entering <code>natas16</code> lets us know that this user exists. However, when we look at the sourcecode we see that we have a problem here:</p> <div class="code-block code-line-numbers" style="counter-reset: code-block 0"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web"> &lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas15&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas15&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; &lt;?php /* CREATE TABLE `users` ( `username` varchar(64) DEFAULT NULL, `password` varchar(64) DEFAULT NULL ); */ if(array_key_exists(&#34;username&#34;, $_REQUEST)) { $link = mysqli_connect(&#39;localhost&#39;, &#39;natas15&#39;, &#39;&lt;censored&gt;&#39;); mysqli_select_db($link, &#39;natas15&#39;); $query = &#34;SELECT * from users where username=\&#34;&#34;.$_REQUEST[&#34;username&#34;].&#34;\&#34;&#34;; if(array_key_exists(&#34;debug&#34;, $_GET)) { echo &#34;Executing query: $query&lt;br&gt;&#34;; } $res = mysqli_query($link, $query); if($res) { if(mysqli_num_rows($res) &gt; 0) { echo &#34;This user exists.&lt;br&gt;&#34;; } else { echo &#34;This user doesn&#39;t exist.&lt;br&gt;&#34;; } } else { echo &#34;Error in query.&lt;br&gt;&#34;; } mysqli_close($link); } else { ?&gt; &lt;form action=&#34;index.php&#34; method=&#34;POST&#34;&gt; Username: &lt;input name=&#34;username&#34;&gt;&lt;br&gt; &lt;input type=&#34;submit&#34; value=&#34;Check existence&#34; /&gt; &lt;/form&gt; &lt;?php } ?&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>So the logical flow is as follows:</p>https://dev-initely.me/natas/level2/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level2/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p>When we open the page, we are greeted with the following message:</p> <p><img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="https://dev-initely.me/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png" data-srcset="https://dev-initely.me/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png, https://dev-initely.me/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png 1.5x, https://dev-initely.me/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png 2x" data-sizes="auto" alt="/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png" title="/home/mor3dr3ad/01_Nextcloud/org-mode/clipboard-20250216T133029.png" /> Okay, the first thing we want to do is check the source code. There is an interesting line here:</p> <div class="code-block code-line-numbers open" style="counter-reset: code-block 0"> <div class="code-header language-html"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">img</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;files/pixel.png&#34;</span><span class="p">&gt;</span></span></span></code></pre></div></div> <p>Looking at the picture we only see one pixel, so nothing interesting there really. However, there is another important information here, which is the filepath <code>files/pixel.png</code>. If we look at URL + <code>/files</code>, then we see that we are actually able to access this folder and find a <code>users.txt</code> file containing the password. <img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="clipboard-20250216T134444.png" data-srcset="clipboard-20250216T134444.png, clipboard-20250216T134444.png 1.5x, clipboard-20250216T134444.png 2x" data-sizes="auto" alt="clipboard-20250216T134444.png" title="clipboard-20250216T134444.png" /></p>https://dev-initely.me/natas/level3/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level3/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas3.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas3.natas.labs.overthewire.org/</a> user: natas3</p> <p>This level starts off the same as before with a screen showing &ldquo;There is nothing on this page&rdquo;. We check the source code for the webpage again and see that this time there is no leak, but an important hint:</p> <p><img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="clipboard-20250216T135120.png" data-srcset="clipboard-20250216T135120.png, clipboard-20250216T135120.png 1.5x, clipboard-20250216T135120.png 2x" data-sizes="auto" alt="clipboard-20250216T135120.png" title="clipboard-20250216T135120.png" /> This is the important line: <code>Not even Google will find it this time...</code>, which is a hint at an existing <code>robots.txt</code>. Indeed, if we type in the URL + <code>/robots.txt</code>, we find a disallowed directory <code>/s3cr3t/</code> containing a <code>user.txt</code> and the password for level 4.</p>https://dev-initely.me/natas/level4/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level4/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas4.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas4.natas.labs.overthewire.org/</a> user: natas4</p> <p>This time the webpage looks different: <img class="lazyload" src="https://dev-initely.me/svg/loading.min.svg" data-src="clipboard-20250216T135754.png" data-srcset="clipboard-20250216T135754.png, clipboard-20250216T135754.png 1.5x, clipboard-20250216T135754.png 2x" data-sizes="auto" alt="clipboard-20250216T135754.png" title="clipboard-20250216T135754.png" /> We get a message saying that we are redirected from the wrong page. This means we need to change the referer header when visiting, we can do this using curl:</p> <div class="code-block code-line-numbers open" style="counter-reset: code-block 0"> <div class="code-header language-bash"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -u natas4:QryZXc2e0zahULdHrtHxzyYkj59kUxLQ --referer http://natas5.natas.labs.overthewire.org/ http://natas4.natas.labs.overthewire.org/</span></span></code></pre></div></div> <ul> <li>0n35PkggAPm2zbEpOU802c0x0Msn1ToK</li> </ul>https://dev-initely.me/natas/level5/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level5/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas5.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas5.natas.labs.overthewire.org/</a> </p> <p>user: natas5</p> <p>The next level is a bit more difficult. We see a message that the user is not logged in. Looking at the page source code does not yield anything usable.</p> <p>Now we need to think about how we log into a page: usually we go to a login page, however appending <code>/login</code> does not yield any result. Let us think about how a login session is usually stored in the browser: usually this is done via the use of cookies.</p>https://dev-initely.me/natas/level6/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level6/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas6.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas6.natas.labs.overthewire.org/</a> </p> <p>user: natas5</p> <p>When we open the webpage we are greeted with the following landing page:</p> <figure><img src="clipboard-20250224T155951.png"> </figure> <p>So we are looking for some kind of secret to input. There is also an auspicious button on the bottom right that lets us view the sourcecode.</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas6&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas6&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; &lt;? include &#34;includes/secret.inc&#34;; if(array_key_exists(&#34;submit&#34;, $_POST)) { if($secret == $_POST[&#39;secret&#39;]) { print &#34;Access granted. The password for natas7 is &lt;censored&gt;&#34;; } else { print &#34;Wrong secret&#34;; } } ?&gt; &lt;form method=post&gt; Input secret: &lt;input name=secret&gt;&lt;br&gt; &lt;input type=submit name=submit&gt; &lt;/form&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>This seems to be some kind of mixture of <code>html</code>, <code>php</code> and <code>javascript</code> with the code in the middle checking for some secret and if that secret is matched, the code will presumably return the password. Only problem: we do not know the secret unfortunately.</p>https://dev-initely.me/natas/level7/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level7/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas7.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas7.natas.labs.overthewire.org/</a> </p> <p>The next level is a bit more cryptic, all we see is this webpage with a &ldquo;Home&rdquo; and &ldquo;About&rdquo; section.</p> <figure><img src="clipboard-20250224T165744.png"> </figure> <p>A look at the page source for this site shows us a hint though:</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web"> &lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas7&#34;, &#34;pass&#34;: &#34;bmg8SvU1LizuWjx3y7xkNERkHxGre0GS&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas7&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; &lt;a href=&#34;index.php?page=home&#34;&gt;Home&lt;/a&gt; &lt;a href=&#34;index.php?page=about&#34;&gt;About&lt;/a&gt; &lt;br&gt; &lt;br&gt; this is the front page &lt;!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 --&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>Apparently the password for the user natas8 is in <code>/etc/natas_webpass/natas8</code>. Appending this simply to the webpage does not produce the result we want. However, if we look closer at the url constructor, we see that it uses <code>?page=home</code> as the constructor for home. So we try and insert the filepath above instead of home:</p>https://dev-initely.me/natas/level8/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level8/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas8.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas8.natas.labs.overthewire.org/</a> </p> <p>Level 8 is a little tricky. We are asked to input a secret again and have a button showing the sourcecode.</p> <figure><img src="clipboard-20250224T233738.png"> </figure> <p>So let&rsquo;s look at the sourcecode:</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;html&gt; &lt;head&gt; &lt;!-- This stuff in the header has nothing to do with the level --&gt; &lt;link rel=&#34;stylesheet&#34; type=&#34;text/css&#34; href=&#34;http://natas.labs.overthewire.org/css/level.css&#34;&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34; /&gt; &lt;link rel=&#34;stylesheet&#34; href=&#34;http://natas.labs.overthewire.org/css/wechall.css&#34; /&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;&gt;&lt;/script&gt; &lt;script src=&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;&gt;&lt;/script&gt; &lt;script src=http://natas.labs.overthewire.org/js/wechall-data.js&gt;&lt;/script&gt;&lt;script src=&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;&gt;&lt;/script&gt; &lt;script&gt;var wechallinfo = { &#34;level&#34;: &#34;natas8&#34;, &#34;pass&#34;: &#34;&lt;censored&gt;&#34; };&lt;/script&gt;&lt;/head&gt; &lt;body&gt; &lt;h1&gt;natas8&lt;/h1&gt; &lt;div id=&#34;content&#34;&gt; &lt;? $encodedSecret = &#34;3d3d516343746d4d6d6c315669563362&#34;; function encodeSecret($secret) { return bin2hex(strrev(base64_encode($secret))); } if(array_key_exists(&#34;submit&#34;, $_POST)) { if(encodeSecret($_POST[&#39;secret&#39;]) == $encodedSecret) { print &#34;Access granted. The password for natas9 is &lt;censored&gt;&#34;; } else { print &#34;Wrong secret&#34;; } } ?&gt; &lt;form method=post&gt; Input secret: &lt;input name=secret&gt;&lt;br&gt; &lt;input type=submit name=submit&gt; &lt;/form&gt; &lt;div id=&#34;viewsource&#34;&gt;&lt;a href=&#34;index-source.html&#34;&gt;View sourcecode&lt;/a&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</code></pre></div> <p>Looking at the sourcecode, we see that there is an encoded secret stored in a variable <code>$encodedSecret</code> using php. Usually it would be difficult to discern the cleartext secret, but if we look at the code we can actually see how the secret is encoded. So let&rsquo;s look at the steps taken in the function <code>encodeSecret()</code>:</p>https://dev-initely.me/natas/level9/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level9/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p><a href="http://natas9.natas.labs.overthewire.org/" target="_blank" rel="noopener noreffer ">http://natas9.natas.labs.overthewire.org/</a> </p> <p>Level 9 again presents a search box and a button to inspect the source code, see screenshot below.</p> <figure><img src="clipboard-20250227T145045.png"> </figure> <p>Looking at the sourcecode, we find the following php code:</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-web"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><pre tabindex="0"><code class="language-web" data-lang="web">&lt;? $key = &#34;&#34;; if(array_key_exists(&#34;needle&#34;, $_REQUEST)) { $key = $_REQUEST[&#34;needle&#34;]; } if($key != &#34;&#34;) { passthru(&#34;grep -i $key dictionary.txt&#34;); } ?&gt;</code></pre></div> <p>The code first takes the user input posted and stores it in a variable <code>$key</code>. It then checks if key is non-empty and passes the variable to the <code>passthru()</code> function. So let&rsquo;s do some digging. A web search for the function gives us the following:</p>https://dev-initely.me/natas/level0/Thu, 27 Mar 2025 14:45:00 +0700https://dev-initely.me/natas/level0/<ul> <li>State &ldquo;DONE&rdquo; from <span class="timestamp-wrapper"><span class="timestamp">[2025-03-27 Thu 14:45]</span></span></li> </ul> <p>First we go to the link that is given and log in using the credentials above. We then get a message saying <code>You can find the password for the next level on this page.</code></p> <p>However, the password is not visible. Looking at the page source we find the following:</p> <div class="code-block open" style="counter-reset: code-block -1"> <div class="code-header language-html"> <span class="code-title"><i class="arrow fas fa-angle-right" aria-hidden="true"></i></span> <span class="ellipses"><i class="fas fa-ellipsis-h" aria-hidden="true"></i></span> <span class="copy" title="Copy to clipboard"><i class="far fa-copy" aria-hidden="true"></i></span> </div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">html</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="c">&lt;!-- This stuff in the header has nothing to do with the level --&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">type</span><span class="o">=</span><span class="s">&#34;text/css&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/level.css&#34;</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/jquery-ui.css&#34;</span> <span class="p">/&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">link</span> <span class="na">rel</span><span class="o">=</span><span class="s">&#34;stylesheet&#34;</span> <span class="na">href</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/css/wechall.css&#34;</span> <span class="p">/&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/jquery-1.9.1.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/jquery-ui.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">http://natas.labs.overthewire.org/js/wechall-data.js</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;&lt;</span><span class="nt">script</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://natas.labs.overthewire.org/js/wechall.js&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">script</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">script</span><span class="p">&gt;</span><span class="kd">var</span> <span class="nx">wechallinfo</span> <span class="o">=</span> <span class="p">{</span> <span class="s2">&#34;level&#34;</span><span class="o">:</span> <span class="s2">&#34;natas0&#34;</span><span class="p">,</span> <span class="s2">&#34;pass&#34;</span><span class="o">:</span> <span class="s2">&#34;natas0&#34;</span> <span class="p">};&lt;/</span><span class="nt">script</span><span class="p">&gt;&lt;/</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">body</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">h1</span><span class="p">&gt;</span>natas0<span class="p">&lt;/</span><span class="nt">h1</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">div</span> <span class="na">id</span><span class="o">=</span><span class="s">&#34;content&#34;</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> You can find the password for the next level on this page. </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c">&lt;!--The password for natas1 is 0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq --&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;/</span><span class="nt">div</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;/</span><span class="nt">body</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;/</span><span class="nt">html</span><span class="p">&gt;</span></span></span></code></pre></div></div> <p>THere is our password!</p>