Level 0:
- SSH into the lab as
bandit0 user
ssh bandit0@bandit.labs.overthewire.org -p 2220
🔒 bandit0
Level 0 -> Level 1:
cat readme
🔒 NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL
Level 1 -> Level 2:
The user has file named - but when tried to read with cat - it shows nothing.
This is because - has a special meaning in Linux
So reading it giving a path from the current location.
cat ./-
🔒 rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi
Level 2 -> Level 3:
cat spaces\ in\ this\ filename
🔒 aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG
Level 3 -> Level 4:
cat inhere/.hidden
🔒 2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe
Level 4 -> Level 5:
file ./*
cat ./-file07
🔒 lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR
Level 5 -> Level 6:
find -type f -size 1033c
cat maybehere07/.file2
🔒 P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU
Level 6 -> Level 7:
find . -size 33c -user bandit7 -group bandit6 2>/dev/null
🔒 z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S
Level 7 -> Level 8:
cat data.txt | grep millionth
🔒 TESKZC0XvTetK0S9xNwm25STk5iWrBvP
Level 8 -> Level 9:
cat data.txt | sort | uniq -c
cat data.txt | sort | uniq -c | grep "1 "
🔒 EN632PlfYiZbn3PhVK3XOGSlNInNE00t
Level 9 -> Level 10:
strings data.txt | grep "======"
🔒 G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s
Level 10 -> Level 11:
- The password is in the
data.txt file but is encoded with Base64 encoding.
cat data.txt | base64 -d
🔒 6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM
Level 11 -> Level 12:
- The password is in the
data.txt file but the password is rotated by 13 position known as ROT13
🔒 JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv
Level 12 -> Level 13:
- Since it is the
hexdump of a compressed file
xxd -r data.txt > data
file data
- Renaming the file to
.gz and extracting with gzip gives the result as data .
mv data data.gz
gzip -d data.gz
file dataNow renaming and using the bzip2 tool.
mv data data.bz2
bzip2 -d data.bz2
mv data.bz2.out data.gz
gzip -d data.gz
file data
🔒 wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw
Level 13 -> Level 14:
- We get ssh private key instead of password.
ssh bandit14@localhost -i sshkey.private -p 2220
cat /etc/bandit_pass/bandit14
🔒 fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq
Level 14 -> Level 15:
- To connect to the localhost at port 30000 we can use
netcat
nc localhost 30000
🔒 jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt
Level 15 -> Level 16:
- For connection using the SSL we can use
openssl or ncat
openssl s_client -connect localhost:30001
ncat --ssl localhost 30001
🔒 JQttfApK4SeyHwDlI9SXGR50qclOAil1
Level 16 -> Level 17:
- For checking the ports in range listening for connection
nmap can be used
nmap -sC -sV -p 31000-32000 localhost
ncat --ssl localhost 31790
chmod 600 private
ssh bandit17@localhost -i private -p 2220
Level 17 -> Level 18:
There are two files password.new and password.old and the password is the only line changed between the two files.
Here, we can use the diff tool which is used to see differences between two files.
diff password.new password.old
🔒 hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg
Level 18 -> Level 19:
- The auto logout is due to exit 0 command at the end of
.bashrc file .
🔒 awhqfNnAbc1naukrpqDYcF95h7HoMTrC
Level 19 -> Level 20:
There is a executable file named bandit20-do which is a setuid binary.
This means the binary can be run with the privilege of the other user bandit20
We can use this to read the contents of the password file for the bandit20 user.
./bandit20-do cat /etc/bandit_pass/bandit20
🔒 VxCazJaVykI6W36BkBU0mJTCM8rR95XT
Level 20 -> Level 21:
- The
suconnect binary connects to localhost at the specified port given as argument
We log in with two session, listen to localhost at 2023
run suconnect binary with 2023 as port
provide the previous password from the listening session which sends it to suconect, which checks the password and returns the password for next level if correct.
nc -lvp 2023
🔒 NvEJF7oVjkddltPSrdKEFOllh9V1IBcq
Level 21 -> Level 22:
The /etc/cron.d directory has a Cronjobfile for the bandit22 user.
Looking at the contents it is running the /usr/bin/cronjob_bandit22.sh script continuously.
The scripts is echoing the password of the bandit22 user into a file in /tmp directory.
Reading the file gives us the password.
🔒 WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff
Level 22 -> Level 23:
- Looking at the script it is copying the password to the file named MD5 sum of the string
I am user $myname
#!/bin/bash
myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget
🔒 QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G
Level 23 -> Level 24:
- Looking at the cron job script of
bandit24 user we see it executes and deletes the scripts present in the /var/spool/bandit24/foo directory
#!/bin/bash
myname=$(whoami)
cd /var/spool/$myname/foo
echo "Executing and deleting all scripts in /var/spool/$myname/foo:"
for i in * .*;
do
if [ "$i" != "." -a "$i" != ".." ];
then
echo "Handling $i"
owner="$(stat --format "%U" ./$i)"
if [ "${owner}" = "bandit23" ]; then
timeout -s 9 60 ./$i
fi
rm -f ./$i
fi
done
We need to create a script at the location and make it executable to all users.
the script will be executed with the privilege of the bandit24 user and we can read the password stored in /etc/bandit_pass/bandit24
#!/bin/bash
cat /etc/bandit_pass/bandit24 > /tmp/pwned
cat /tmp/pwned
🔒 VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar
Level 24 -> Level 25:
#!/bin/bash
for i in {0..9}
do
for j in {0..9}
do
for k in {0..9}
do
for l in {0..9}
do
echo "VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar $i$j$k$l" >> pin.txt
done
done
done
done
for i in {0000..9999};do echo$i >> pin.txt ; done
- We then pipe the combination to the service and store response in a text file
cat pin.txt | nc localhost 30002 > response
🔒 p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d
Level 25 -> Level 26:
#!/bin/sh
export TERM=linux
exec more ~/text.txt
exit 0
- The exec command shows the following result. The content is after "Enjoy you stay!".
Looking at the man page of the more command we figure we can go into vim while reading in more mode by pressing the V key .
We then make our terminal so small that it automatically goes to more when showing the text in *text.txt* file.
we then read file in vim by going to normal mode and entering the following command.
:r /etc/bandit_pass/bandit26
:set shell=/bin/bash
:! cat /etc/bandit_pass/bandit26
:! /bin/bash
🔒 c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1
Level 26 -> Level 27:
- We have a SUID binary by
bandit27 user which takes command as argument.
./bandit27-do cat /etc/bandit_pass/bandit27
🔒 YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS
Level 27 -> Level 28:
git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo
- Reading the
README file in the repository which has the password.
🔒 AVanL161y9rsbcJIsFHuw35rjaOM19nR
Level 28 -> Level 29:
- Cloning the git repository we see the password is hidden
- Since it is a git repository the changes are saved. Viewing git log
- the latest commit message indicates some credentials leak so we checkout to the previous commit.
- Read the
Readme file again
🔒 tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S
Level 29 -> Level 30:
- The
readme file shows no password
- The log also do not have any information
- But if we look at the branch in remote location we see some more branches
- If we observe the password field at the
readme, it gives hint as not in the production
git checkout dev
🔒 xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS
Level 30 -> Level 31:
git tag
git show secret
🔒 OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt
Level 31 -> Level 32:
- Reading the
README file we know the task to be performed
🔒 rmCBvG56y58BXzv98yZGdO7ATVL5dW8y
Level 32 -> Level 33:
Upon ssh we get a shell where every command is converted to upper shell and then executed
However environment variables like SHELL are accessible as they are in upper case.
we execute $0 which represent the command which runs the program or binary.
Eg. /bin/bash uppershell $0 represents /bin/bash and $1 represent uppershell which is the argument.
We get the shell of bandit33
on inspection we can see that uppershell is a binary with suid set to bandit33 and group bandit32 has the executable permission.
From this we might guess, upon login through ssh /bin/bash uppershell command was executed.
Thank You !!!
