> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2025/wapt-module-natas/natas-8.md).

# Natas 8

When the webpage first loads, there is nothing interesting except the view sourcecode, so lets go there immediately

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FmaCEE8Bhp7yma8zl7Ew2%2Fimage.png?alt=media&amp;token=14a96013-d5fa-451c-aff6-9e912b91aefa" alt=""><figcaption></figcaption></figure>

In the source code itself, once again like Natas 6, there is some interesting php code

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2F3a5Xe2AOFq1xXlqD6LYR%2Fimage.png?alt=media&amp;token=67ba9b88-3dd2-4558-8ece-4716c622bc9b" alt=""><figcaption></figcaption></figure>

```php
<?

$encodedSecret = "3d3d516343746d4d6d6c315669563362";

function encodeSecret($secret) {
    return bin2hex(strrev(base64_encode($secret)));
}

if(array_key_exists("submit", $_POST)) {
    if(encodeSecret($_POST['secret']) == $encodedSecret) {
    print "Access granted. The password for natas9 is <censored>";
    } else {
    print "Wrong secret";
    }
}
?>
```

The string `return bin2hex(strrev(base64_encode($secret)));` simply encodes it in base64, reverses the string and converts it to hexadecimal. By reverse engineering this in CyberChef

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2Fc6RcoUVUQJdowLxnu7d7%2Fimage.png?alt=media&amp;token=40bd18ee-e99d-4ecc-8b69-2547cbd4cd07" alt=""><figcaption><p>We obtain the password</p></figcaption></figure>

Entering this into the Input gives the following

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FmOoNcbmZkgrpcbZ99ELP%2Fimage.png?alt=media&amp;token=c602d73e-dcd4-4d25-b57b-aac6331b8099" alt=""><figcaption></figcaption></figure>

Thus the password is `ZE1ck82lmdGIoErlhQgWND6j2Wzz6b6t`
