Level 8

State “DONE” from [2025-03-27 Thu 14:45]

http://natas8.natas.labs.overthewire.org/

Level 8 is a little tricky. We are asked to input a secret again and have a button showing the sourcecode.

So let’s look at the sourcecode:

<html>
    <head>
        <!-- This stuff in the header has nothing to do with the level -->
        <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
        <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
        <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
        <script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
        <script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
        <script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
        <script>var wechallinfo = { "level": "natas8", "pass": "<censored>" };</script></head>
    <body>
        <h1>natas8</h1>
        <div id="content">

            <?

            $encodedSecret = "3d3d516343746d4d6d6c315669563362";

            function encodeSecret($secret) {
            return bin2hex(strrev(base64_encode($secret)));
            }

            if(array_key_exists("submit", $_POST)) {
            if(encodeSecret($_POST['secret']) == $encodedSecret) {
            print "Access granted. The password for natas9 is <censored>";
            } else {
            print "Wrong secret";
            }
            }
            ?>
            <form method=post>
                Input secret: <input name=secret><br>
                <input type=submit name=submit>
            </form>

            <div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
        </div>
    </body>
</html>

Looking at the sourcecode, we see that there is an encoded secret stored in a variable $encodedSecret using php. Usually it would be difficult to discern the cleartext secret, but if we look at the code we can actually see how the secret is encoded. So let’s look at the steps taken in the function encodeSecret():

bin2hex: searching for bin2hex, we can find this site which describes what the function does: Returns an ASCII string containing the hexadecimal representation of string. The conversion is done byte-wise with the high-nibble first. We also see that there is a reverse function hex2bin(). Using the code editor on its site we can reverse the encoding.
Next in line is the strrev function which just reverses a string. So re-reversing the string we can move to the next step.
Finally, base64_encode encodes a given string with base64. The corresponding site for base64_decode will let us use its code editor to input the reverted string and get the final secret. If we input this into the text field on the original page, we get back the password for the next level.
ZE1ck82lmdGIoErlhQgWND6j2Wzz6b6t