Natas9
Natas Level 9 — user input is passed into a shell command; learn what OS command injection is and why shell metacharacters are dangerous.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
Username: natas9
URL: http://natas9.natas.labs.overthewire.org
Study guide
Level map: sign in as natas9 and find the password for natas10.
What this level teaches
How building a shell command from user input lets the user add commands of their own.
Key ideas
- Shell metacharacters. Characters such as
;,|and&have special meaning and let a user chain additional commands. - Reading the source. The page shows its code, including the exact command string it builds; it is the key to everything.
- Where the password lives. Natas keeps each level’s password in
/etc/natas_webpass/, which the web user for this level can read.
How to approach it
- Read the PHP source and write down the command it constructs from your input.
- Think about what input would end that command and start another.
How developers prevent it
Avoid shelling out. If you must, pass arguments as separate parameters without a shell, validate against an allow-list and escape the rest.