Hacking - Tag - Coding braindumphttps://dev-initely.me/tags/hacking/Hacking - Tag - Coding braindumpHugo -- gohugo.ioenSat, 13 Jun 2026 05:55:00 +0200AUR Supply Chain Attack: How to check your (Arch Linux) Systemhttps://dev-initely.me/posts/aur-supply-chain-attack/Sat, 13 Jun 2026 05:55:00 +0200mor3dr3adhttps://dev-initely.me/posts/aur-supply-chain-attack/The supply chain attacks on linux just keep coming: in June 2026, a malicious package was discovered in the Arch User Repository (AUR). I first read about this in ioctl.fail. Here is what happened in the short version (for long version go to ioctl.fail).

An attacker masked a binary by hiding it in the dependency tree of (the legitimate package) atomic-lockfile (v1.4.2). The hidden binary runs at install time via an npm hook. It is designed to steal credentials, installs a persistent systemd service and loads an eBPF rootkit to hide itself and exfiltrates everything over Tor. All silently - so this is pretty advanced stuff.

]]>Level 16https://dev-initely.me/natas/level16/Wed, 02 Apr 2025 22:58:00 +0200mor3dr3adhttps://dev-initely.me/natas/level16/
  • State “DONE” from “TODO” [2025-04-02 Wed 22:58]

    • http://natas16.natas.labs.overthewire.org/

    So there is one input field and a comment that for security reasons, the code now filters on more characters. There is also a output field below, supposedly to give back a response from the search request.

    Alright, let’s look at the sourcecode:

    <html>
    <head>
        <!-- This stuff in the header has nothing to do with the level -->
        <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
        <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
        <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
        <script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
        <script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
        <script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
        <script>var wechallinfo = { "level": "natas16", "pass": "<censored>" };</script></head>
    <body>
        <h1>natas16</h1>
        <div id="content">

            For security reasons, we now filter even more on certain characters<br/><br/>
            <form>
                Find words containing: <input name=needle><input type=submit name=submit value=Search><br><br>
            </form>

            Output:
            <pre>
<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    if(preg_match('/[;|&`\'"]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i \"$key\" dictionary.txt");
    }
}
?>
            </pre>

            <div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
        </div>
    </body>
</html>

    Shell injection

    At first impression, this looks very much like level 9 above; if you need a reminder, go look at the walkthrough for it. We made use of the fact that passthru() does not sanitize and where able to insert some shell code into the grep command like so test; whoami.

    ]]>    Level 1https://dev-initely.me/natas/level1/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level1/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • You can find the password for the next level on this page, but rightclicking has been blocked!

    And indeed: we try to rightclick and get an annoying error message. However, a quick google search shows us that there is a shortcut for Chrome: CTRL + U gets us the page source

    <html>
  <head>
    <!-- This stuff in the header has nothing to do with the level -->
    <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
    <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
    <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
    <script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
    <script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
    <script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
    <script>var wechallinfo = { "level": "natas1", "pass": "0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq" };</script></head>
  <body oncontextmenu="javascript:alert('right clicking has been blocked!');return false;">
    <h1>natas1</h1>
    <div id="content">
      You can find the password for the
      next level on this page, but rightclicking has been blocked!

      <!--The password for natas2 is TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI -->
    </div>
  </body>
</html>
    • TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI
    ]]>    Level 10https://dev-initely.me/natas/level10/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level10/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas10.natas.labs.overthewire.org/

    Level 10 starts off the same way as level 9, however it seems that now there is a filter against certain characters.

    Looking at the sourcecode, we see that the characters ;|& are now disallowed. However, space is not disallowed.

    <?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
$key = $_REQUEST["needle"];
}

if($key != "") {
if(preg_match('/[;|&]/',$key)) {
print "Input contains an illegal character!";
} else {
passthru("grep -i $key dictionary.txt");
}
}
?>

    So the strategy from level 9 will not work anymore. However, there is another way to exploit this - we can use the fact that grep can search through several files.

    ]]>    Level 11https://dev-initely.me/natas/level11/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level11/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas11.natas.labs.overthewire.org/

    This level seems to work with an encryption called XOR encryption:

    Background

    Okay, some theory first: what is an XOR cipher? It is a type of additive cipher that works with the applying the bitwise XOR operator to every character using a given key. To decrypt, applying the XOR function with the key will remove the cipher. To take an example from Wikipedia, let’s take the string ‘Wiki’ and encode it in 8-bit ASCII and encode it with the key 11110011:

    ]]>    Level 12https://dev-initely.me/natas/level12/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level12/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas12.natas.labs.overthewire.org/

    This one took me quite a while to figure out using several tutorials from different websites. First we see an upload dialogue allowing us to upload a JPEG file.

    Background

    If a webpage allows to upload files, the developer has to make sure that the backend checks appropriately for filetypes and malicious intent. So here I assume that no proper checking is done and we can do something malicious.

    ]]>    Level 13https://dev-initely.me/natas/level13/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level13/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas13.natas.labs.overthewire.org/

    This one looks very similar to the prior exercise, so let’s start the same way and look at the source code.

    <html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas13", "pass": "<censored>" };</script></head>
<body>
<h1>natas13</h1>
<div id="content">
For security reasons, we now only accept image files!<br/><br/>

<?php

function genRandomString() {
    $length = 10;
    $characters = "0123456789abcdefghijklmnopqrstuvwxyz";
    $string = "";

    for ($p = 0; $p < $length; $p++) {
        $string .= $characters[mt_rand(0, strlen($characters)-1)];
    }

    return $string;
}

function makeRandomPath($dir, $ext) {
    do {
    $path = $dir."/".genRandomString().".".$ext;
    } while(file_exists($path));
    return $path;
}

function makeRandomPathFromFilename($dir, $fn) {
    $ext = pathinfo($fn, PATHINFO_EXTENSION);
    return makeRandomPath($dir, $ext);
}

if(array_key_exists("filename", $_POST)) {
    $target_path = makeRandomPathFromFilename("upload", $_POST["filename"]);

    $err=$_FILES['uploadedfile']['error'];
    if($err){
        if($err === 2){
            echo "The uploaded file exceeds MAX_FILE_SIZE";
        } else{
            echo "Something went wrong :/";
        }
    } else if(filesize($_FILES['uploadedfile']['tmp_name']) > 1000) {
        echo "File is too big";
    } else if (! exif_imagetype($_FILES['uploadedfile']['tmp_name'])) {
        echo "File is not an image";
    } else {
        if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
            echo "The file <a href=\"$target_path\">$target_path</a> has been uploaded";
        } else{
            echo "There was an error uploading the file, please try again!";
        }
    }
} else {
?>

<form enctype="multipart/form-data" action="index.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="1000" />
<input type="hidden" name="filename" value="<?php print genRandomString(); ?>.jpg" />
Choose a JPEG to upload (max 1KB):<br/>
<input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload File" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

    The code introduces some additional file checking, specifically here:

    ]]>    Level 14https://dev-initely.me/natas/level14/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level14/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas14.natas.labs.overthewire.org/

    Level 14 starts with a common username and passwword login form:

    Trying a random value yields a simple message: “Access denied”. So have a look at the sourcecode:

    

<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas14", "pass": "<censored>" };</script></head>
<body>
<h1>natas14</h1>
<div id="content">
    <?php
    if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas14', '<censored>');
    mysqli_select_db($link, 'natas14');

    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\" and password=\"".$_REQUEST["password"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    if(mysqli_num_rows(mysqli_query($link, $query)) > 0) {
            echo "Successful login! The password for natas15 is <censored><br>";
    } else {
            echo "Access denied!<br>";
    }
    mysqli_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

    The code first checks if a username is provided, then establishes a connection to MySQL using the username natas14 and selects the natas14 database. Then it constructs the SQL query with the input from the input form. The script then runs the SQL query and checks if any rows match the username and password. Finally, it closes the connection.

    ]]>    Level 15https://dev-initely.me/natas/level15/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level15/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • http://natas15.natas.labs.overthewire.org/

    This level starts very similar to level 14, however no we only check for the existence of a user using an input field:

    Entering natas16 lets us know that this user exists. However, when we look at the sourcecode we see that we have a problem here:

      <html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas15", "pass": "<censored>" };</script></head>
<body>
<h1>natas15</h1>
<div id="content">
<?php

/*
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
*/

if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas15', '<censored>');
    mysqli_select_db($link, 'natas15');

    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    $res = mysqli_query($link, $query);
    if($res) {
    if(mysqli_num_rows($res) > 0) {
        echo "This user exists.<br>";
    } else {
        echo "This user doesn't exist.<br>";
    }
    } else {
        echo "Error in query.<br>";
    }

    mysqli_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
<input type="submit" value="Check existence" />
</form>
<?php } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

    So the logical flow is as follows:

    ]]>    Level 2https://dev-initely.me/natas/level2/Thu, 27 Mar 2025 14:45:00 +0100mor3dr3adhttps://dev-initely.me/natas/level2/
  • State “DONE” from [2025-03-27 Thu 14:45]

    • When we open the page, we are greeted with the following message:

    Okay, the first thing we want to do is check the source code. There is an interesting line here:

    <img src="files/pixel.png">

    Looking at the picture we only see one pixel, so nothing interesting there really. However, there is another important information here, which is the filepath files/pixel.png. If we look at URL + /files, then we see that we are actually able to access this folder and find a users.txt file containing the password.

    ]]>