[WALKTHROUGH] OverTheWire - Natas0 - Natas 10

Natas, is another Wargame hosted by OverTheWire, which is solely focusing on server-side web security... You can head over and give this Wargame a try, which I strongly recommend to the beginner, especially those who interested in web security... The Wargame is hosted for all day long and all seasons, so no time restraints and solely self-pace...

Natas concluded altogether 27 levels as for the moment I am writing this write up... The level difficulty increase as you go through and it is definitely challenging enough for amateur like me... Each level of Natas located at their URL respectively and no SSH login like previous Wargame posted here...

To access to a specific level, enter the mentioned URL for that level and input the username and password... As usual, you can only access the next level after you capture the flag at current level... Please take note that the passwords are stored in /etc/natas_webpass/natasX where X is the current level number...

Let's start from the beginning, Natas0:
URL: http://natas0.natas.labs.overthewire.org
Username: natas0
Password: natas0

A very big hint given for the starter page... "You can find the password for the next level on THIS page"...  as for my usual practice, the first thing I'm going to do is to scrap the page source...

The password for next level is given and shown obviously in the page source...

Reaching level 1, I had been warned that rightclicking has been blocked... so what should I do? Simply disable your Javascript for your browser will do...

Same trick as previous level, scrap and view the page source code... the password for next level will be very obvious to be seen...

Level2 tells me that there is nothing on this page... but that doesn't stop me from viewing the page source code again...

Noticed the directory for the pixel.png file is located at "files/pixel.png"... So this means this web server has a directory named "files"...

From the "files" directory, I can see the "pixel.png" file together with a "users.txt" text file... This seems interesting to me...

Opened up the "users.txt" text file revealed the password for the next level...

Reaching the level 3, but I'm told the same message as previous level... Well, who cares as I am going to look into the page source code anyhow...

This time I am no longer seeing any directory available in the page source and I was told that no more information, not even Google can help me on this... If Google cannot tell me, which means Google don't know, and that lead me to "robots.txt", where Google stop spider crawl the sub-directory of a domain if listed in the robots.txt...

"robots.txt" tells me that there is one sub-directory with the name "s3cr3t", which is the l33t speak of the word "secret"... Obviously, the credential can be found in this way...

Having the same name "users.txt" text file as previous level... 

Checked out the file and reveal the password for the next level...

Natas4 tells me that access disallowed as the authorized users should come only from Natas5's URL... So, I fire up my BurpSuite for a better understanding the stuff running behind...

 From the BurpSuite, I can see the referer is from Natas4's URL, which is probably disallowed and not authorized in this page... Hence, I change the natas4 into natas5 as the referer....

Forward the packet...

 And, I am brought up with the password to the next level...

Natas5 basically tells me the same thing, which I am disallowed to access this page... so, no doubt I checking with the BurpSuite again...

Found out there is one parameters in the Cookie named "loggedin" with the value "0"... Changing the value from "0" to "1" should be log me in this time...

And, I was correct... the password for next level is given on the page...

This time, Natas6 asks me to input the secret keyword... but wait! There is a "View sourcecode" link, which might provide me some better idea...

The source code tells me that the page contained a file at "includes/secret.inc"... and I tried navigate to the link which provide me a blank page... out of curiousity, I right clicked on the page and view the page source...

Secret keyword is given... back to the first page and input the secret keyword...

As expected, the password for next level is given after we input the secret keyword...

Coming to Natas7, I only see two links "Home" and "About"... so I checked out the page source codes again...

This seems like a directory traversal vulnerability to me... The comment part in the source codes even tells me where the password located...

By navigate to the password location, the page returns me with the password to Natas8...

Natas8 is having the exact design and layout at Natas6, which confused me at some point that I thought I going to the wrong level... But thankful enough that the page clearly mentioned I am at the level 8 by contrasting the words "NATAS8" at the top left corner...

So, I went over and view on the source code again by going through the provided link...

The php code basically compare the encoded version of input secret keyword with the existing encoded secret code, the page will returns the password for natas9 if it is true... so, I wrote a php code to reverse engineer its encoding process...

Got the reversed secret code and input into the form...

As expected, the page returns with the password for next level...

 Natas9 is like a keyword search engine that ask us to input "words" to be searched... since I shall not rush and I take a look into the "magic" behind instead...

So, the page perform `grep` command on the dictionary.txt with the keyword inputted... but the command seems like not sanitized, so we can just end the command with ';' and display the content of "/etc/natas_webpass/natas9" using the `cat` command... not to forget comment out the codes behind as I only care about the password for next level... 

Password for the next level is `cat`-ed out and shown on the page itself...

Reached the level 10 and I am told the security has been tightened compared to level 9 and it filter on certain characters... For clearer picture, I decided to view on the source code again...

This time the input is sanitized with characters filtering... I can no longer input semi-colon, or, ampersand... but it does not filter "*" asterisk sysmbol, which is good enough for me to display the content of the password... using the same pattern as previous level and replaced with the regex ".*" to display everything instead with ";" which is to end the command beforehand...

And, this is how I found the password for next level...

[WALKTHROUGH] OverTheWire - Leviathan

So, I have completed the Wargame hosted by OverTheWire, Leviathan.. I would say this is a very good challenge for beginner like me, that familiarize myself with the Linux system...

The challenge is free and is always available to tryout... 

Some info provided by the host regarding the difficulty and number of challenges for this particular wargame...

As per instructed, let's start up with SSH into the leviathan0@leviathan.labs.overthewire.org...

Although the initial password for leviathan0 is not given, or not that I'm aware of... I found out the password to kick off is actually the same as the starting hostname... 'leviathan0'...

I'm given the hint that the data for the levels can be found in the 'home' directory, so I just check out the available file by using the command `ls -la`...

Nothing special with the directory, except I have found a '.backup' folder...

Checking out the backup folder and I saw a 'bookmarks.html' file...

Displaying all the contents of the html file is too much and too hard for me to inspect properly to see if any credentials listed to access the next level...

At once, I `cat` all the contents of the html file and `grep` the keyword "password"... and I found the password access to the next level...

so, I do a `ssh leviathan1@localhost` and input the password found earlier... and I got myself as the user leviathan1...

Again, checking out the home directory...and I got a "check" file...

As I am not sure what is the "check" file, I inspect the file using `file` command and it returns that the file is a 32-bit executable file...

I execute the file and it prompted for password...

So, I tried running the file with `ltrace` to see what is happening behind...

I found the strcmp function, which comparing the input with the exact password "sex" here...

Again, I execute the "check" file and input the password "sex"... I was dropped into another shell as user "leviathan2"...

Using the privilege of "leviathan2", I `cat` the password for the user itself at "/etc/leviathan_pass/leviathan2"...

Exited the shell and do `ssh leviathan2@localhost` with the password found earlier to get a more proper shell...

Checking out the files in home directory again... I found the executable "printfile", which literally display the content of the file (something like the `cat` command)...

However, when I tried to display the content of "/etc/leviathan_pass/leviathan3", it failed...

So, I inspect further with the file "printfile" to see if it has any vulnerable point itself...

I tried create a file named as "test file" with the intentional space left in the middle of the file name...

And, checking the back-end running of the "printfile" using the `ltrace`...

From the `ltrace` command, I can see the "printfile" check the permission of the input file using the access() function and `cat` out the content of "test" file and "file" file...

Basically, it `cat` out the content of two files with separated file name instead of one files as inputted...

So, I create a symlink from the "/etc/leviathan_pass/leviathan3" to my current working folder "test" file...

And, when I execute the "printfile" with inputting the "test file" as argument... the system actually `cat` out the content of "test" file instead of "test file"... and with the help of symlink, the "test" file will be pointing to the leviathan3 password file...

 Then, continue with `ssh leviathan3@localhost` and input the password...

Checking out the home directory again and found the suspicious "level3" file...

Perform a `strings` on the "level3" file and we can see the message "[You've got shell]!"... and right before the message, we got a string "snlprintf", which is very likely the keyword to pass...

Enter the keyword as password and I'm dropped into the shell as "leviathan4"...

Perform `cat` out the contents of "/etc/leviathan_pass/leviathan4" will provide the password to login as "leviathan4"...

After `ssh leviathan4@localhost`, I checked out the home directory again and saw a "trash" folder...

Inside the "trash" folder contained a executable "bin" file...

`cat` out the content of the "bin" file and we can see some binary '0' and '1'...

Parse it to the online converter and we got the ASCII test as password for next level...

`ssh leviathan5@localhost` and checked out the home directory AGAIN...

`file` inspect on the "leviathan5" file, which is obviously holding the key to the next level...

Tried execute the file, but it shows the message "Cannot find /tmp/file.log"...

A very straightforward hint, that I created the mentioned "/tmp/file.log" and tried execute the "leviathan5" file again...

As expected, it print out the content which I input into the "file.log"...

However, when I tried to `cat` the content of the "file.log" again... system return with a message "No such file or directory"...

So I guess the "leviathan5" file actually remove the "file.log" right after displaying the content of the file...

Hence, I created another symlink to link the password file for leviathan6 at "/etc/leviathan_pass/leviathan6" to "/tmp/file.log" and execute the "leviathan5" file to display the password content...

Login as user "leviathan6" and scouting at the home directory again...

Now I have an executable "leviathan6" file...

Tried run the "leviathan6" file and it asked for a 4-digit code...

Run a very simple bash command to simply brute force the "leviathan6" from 0000 - 9999...

As the iteration running, it finally stopped at code "7123" and immediately dropped into another shell as "leviathan7"...

`cat` out the password content at "/etc/leviathan_pass/leviathan7" and login as "leviathan7"...

After advanced into the final level, there is a "CONGRATULATIONS" note in the home directory...

Read the note and the challenge is completed... :)