# Complete Walkthrough for Overthewire Bandit

# Level 0:

* SSH into the lab as `bandit0` user
    

```bash
ssh bandit0@bandit.labs.overthewire.org -p 2220
```

```plaintext
🔒 bandit0
```

# Level 0 -> Level 1:

* The home folder for the user `bandit0` has a `readme` file.
    
* Reading the file contents with cat command gives the password.
    

```bash
cat readme
```

```plaintext
🔒 NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL
```

# Level 1 -> Level 2:

* The user has file named `-` but when tried to read with `cat -` it shows nothing.
    
* This is because `-` has a special meaning in Linux
    
* So reading it giving a path from the current location.
    

```bash
cat ./-
```

```plaintext
🔒 rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi
```

# Level 2 -> Level 3:

* The file name in this case contains spaces.
    
* Reading the file normally will result in error because Linux will treat them as separate files when spaces is present so need to escape them.
    

```bash
cat spaces\ in\ this\ filename
```

```plaintext
🔒  aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG
```

# Level 3 -> Level 4:

* The file is inside `inhere` folder and the file is hidden.
    
* The file name can be viewed by running `ls -al inhere` command.
    
* Now view the file.
    

```bash
cat inhere/.hidden
```

```plaintext
🔒 2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe
```

# Level 4 -> Level 5:

* The `inhere` has many file but the password is in the human readable file
    
* Using `file` command can give us the type of file and its information
    

```bash
file ./*
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774067919/9ed62a3e-51ca-4c88-ae50-c4d52a3967ce.png align="center")

```bash
cat ./-file07
```

```plaintext
🔒 lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR
```

# Level 5 -> Level 6:

* There are many folders and inside them many file where finding manually is not a viable option
    
* So using the find command to find the file described in the specification.
    

```bash
find -type f -size 1033c
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774080804/30a18d54-f1dc-4af6-afab-f4047c5b0b69.png align="center")

```bash
cat maybehere07/.file2
```

```plaintext
🔒 P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU
```

# Level 6 -> Level 7:

* This time the file can be anywhere in the system
    
* Using find command to get the specific file and using `2>/dev/null` will not print the error in the terminal.
    

```bash
find . -size 33c -user bandit7 -group bandit6 2>/dev/null
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774103104/4d1b2612-d77e-44fe-a387-dfa40d47ac95.png align="center")

```plaintext
🔒 z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S
```

# Level 7 -> Level 8:

* The password is in the very large file next to the word `millionth`
    
* Using `grep` to get the line with the matching word.
    

```bash
cat data.txt | grep millionth
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774117004/d0b67d30-de45-4732-b75d-1d60a0c62691.png align="center")

```plaintext
🔒 TESKZC0XvTetK0S9xNwm25STk5iWrBvP
```

# Level 8 -> Level 9:

* The password is the unique text in a large file.
    
* We can use `sort` tool to sort the entire file in combination with `uniq` tool which removes the consecutive duplicate line
    

```bash
cat data.txt | sort | uniq -c
cat data.txt | sort | uniq -c | grep "1 "
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774129328/d45c7dc8-c7b9-4e5d-88f6-80b1b8f67070.png align="center")

```plaintext
🔒 EN632PlfYiZbn3PhVK3XOGSlNInNE00t
```

# Level 9 -> Level 10:

* The human readable strings can be extracted from a non-text file using the `strings` command.
    
* We can then use `grep` to find the line with `====` characters.
    

```bash
strings data.txt | grep "======"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774163280/60e7589b-a05d-41f6-a961-fac29f4a8627.png align="center")

```plaintext
🔒 G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s
```

# Level 10 -> Level 11:

* The password is in the `data.txt` file but is encoded with Base64 encoding.
    

```bash
cat data.txt | base64 -d
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774172131/ba20a682-700c-43df-93b8-812fc1c05f93.png align="center")

```plaintext
🔒 6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM
```

# Level 11 -> Level 12:

* The password is in the `data.txt` file but the password is rotated by 13 position known as ROT13
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774188844/fba3cb18-218a-460e-b0a4-be83043285e4.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774204221/57889f2d-5933-4673-a2a2-e30f6bd1602e.png align="center")

```plaintext
🔒 JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv
```

# Level 12 -> Level 13:

* Since it is the `hexdump` of a compressed file
    

```bash
xxd -r data.txt > data
```

```bash
file data
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774214270/4e9a18f5-bbd9-4fa8-beb9-0e9f4ce949a4.png align="center")

* Renaming the file to `.gz` and extracting with `gzip` gives the result as `data` .
    

```bash
mv data data.gz
gzip -d data.gz
file dataNow renaming and using the bzip2 tool.
```

```bash
mv data data.bz2
bzip2 -d data.bz2
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774261374/f51a7e27-efdf-4ea1-b90d-90d9c6e56493.png align="center")

```bash
mv data.bz2.out data.gz
gzip -d data.gz
file data
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774300958/2dd3e528-47c2-4ba7-888b-0c56dd32df07.png align="center")

* Same process
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774316898/720932b0-106f-4634-9007-d6782e8804d1.png align="center")

```plaintext
🔒 wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw
```

# Level 13 -> Level 14:

* We get ssh private key instead of password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774360076/6a5345a3-df0b-4346-bce0-1b18d4c9b3ed.png align="center")

* The password is stored in `/etc/bandit_pass/bandit14` and is only readable by `bandit14` user.
    
* First ssh as `bandit14` user and read the password file
    

```bash
ssh bandit14@localhost -i sshkey.private -p 2220
cat /etc/bandit_pass/bandit14
```

```plaintext
🔒 fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq
```

# Level 14 -> Level 15:

* To connect to the [localhost](http://localhost) at port 30000 we can use `netcat`
    

```bash
nc localhost 30000
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774407320/1c30af15-b6c8-4f88-b084-25161de5187a.png align="center")

```plaintext
🔒 jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt
```

# Level 15 -> Level 16:

* For connection using the SSL we can use `openssl` or `ncat`
    

```bash
openssl s_client -connect localhost:30001
ncat --ssl localhost 30001
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774429923/b2656e0d-93b6-412c-8f72-9a7e422d8ed2.png align="center")

```plaintext
🔒 JQttfApK4SeyHwDlI9SXGR50qclOAil1
```

# Level 16 -> Level 17:

* For checking the ports in range listening for connection `nmap` can be used
    

```bash
nmap -sC -sV -p 31000-32000 localhost
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722774468468/89bf7ab6-965c-46d8-853c-3f498bfad49a.png align="center")

* The service for port 31790 is not echo so it is the valid one.
    
* Sending the request and password to the service gives the ssh private key instead of password.
    

```bash
ncat --ssl localhost 31790
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722772819855/87ae9757-375b-4fd9-8741-b18ab88d7b52.png align="center")

* Save the private key to a file `/tmp/sd/private`
    
* change the permission to 600
    

```bash
chmod 600 private
```

```bash
ssh bandit17@localhost -i private -p 2220
```

# Level 17 -> Level 18:

* There are two files [`password.new`](http://password.new) and `password.old` and the password is the only line changed between the two files.
    
* Here, we can use the `diff` tool which is used to see differences between two files.
    

```bash
diff password.new password.old
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722772841293/78c71014-36ad-4b46-8d6b-15be4fe51c79.png align="center")

```plaintext
🔒 hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg
```

# Level 18 -> Level 19:

* We get logged out as soon as we logged in due to some commands in `.bashrc`
    
* We can send commands to run after ssh to read the `readme` file before the session exit.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722772851708/09daf86c-753b-46ac-a15c-3004b1cdfc12.png align="center")

* The auto logout is due to exit 0 command at the end of `.bashrc` file .
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722772862723/11e28509-5f3b-40ed-8d5a-8e66a5e0a121.png align="center")

```plaintext
🔒 awhqfNnAbc1naukrpqDYcF95h7HoMTrC
```

# Level 19 -> Level 20:

* There is a executable file named `bandit20-do` which is a setuid binary.
    
* This means the binary can be run with the privilege of the other user `bandit20`
    
* We can use this to read the contents of the password file for the `bandit20` user.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722772957849/08d961df-d1e9-4b2d-801c-d5c2905df2d1.png align="center")

```bash
./bandit20-do cat /etc/bandit_pass/bandit20
```

```plaintext
🔒 VxCazJaVykI6W36BkBU0mJTCM8rR95XT
```

# Level 20 -> Level 21:

* The `suconnect` binary connects to [localhost](http://localhost) at the specified port given as argument
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773020128/9b6e6246-12cc-46ab-9221-cc127a1df14c.png align="center")

* We log in with two session, listen to [localhost](http://localhost) at 2023
    
* run `suconnect` binary with 2023 as port
    
* provide the previous password from the listening session which sends it to `suconect`, which checks the password and returns the password for next level if correct.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773027457/d89358af-3dad-4a09-b7b8-fcfb4e033ebc.png align="center")

```bash
nc -lvp 2023
```

```plaintext
🔒 NvEJF7oVjkddltPSrdKEFOllh9V1IBcq
```

# Level 21 -> Level 22:

* The `/etc/cron.d` directory has a Cronjobfile for the `bandit22` user.
    
* Looking at the contents it is running the `/usr/bin/cronjob_`[`bandit22.sh`](http://bandit22.sh) script continuously.
    
* The scripts is echoing the password of the `bandit22` user into a file in `/tmp` directory.
    
* Reading the file gives us the password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773043584/8d7644ad-14d3-4fff-82a6-3b5de805bb9f.png align="center")

```plaintext
🔒 WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff
```

# Level 22 -> Level 23:

* looking at the cron job
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773086134/d085e269-609d-424a-90b8-92ed1acc5b93.png align="center")

* Looking at the script it is copying the password to the file named MD5 sum of the string `I am user $myname`
    

```bash
#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget
```

* Since the user we want the password for is `bandit23`.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773100008/534f2544-4df4-4991-a3e0-7631c6c062a0.png align="center")
    
* Now reading the file with name as the md5 hash
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773110508/935982c1-a5a9-430d-b109-6bdbf3c1a090.png align="center")

```plaintext
🔒 QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G
```

# Level 23 -> Level 24:

* Looking at the cron job script of `bandit24` user we see it executes and deletes the scripts present in the `/var/spool/bandit24/foo` directory
    

```bash
#!/bin/bash

myname=$(whoami)

cd /var/spool/$myname/foo
echo "Executing and deleting all scripts in /var/spool/$myname/foo:"
for i in * .*;
do
    if [ "$i" != "." -a "$i" != ".." ];
    then
        echo "Handling $i"
        owner="$(stat --format "%U" ./$i)"
        if [ "${owner}" = "bandit23" ]; then
            timeout -s 9 60 ./$i
        fi
        rm -f ./$i
    fi
done
```

* We need to create a script at the location and make it executable to all users.
    
* the script will be executed with the privilege of the `bandit24` user and we can read the password stored in `/etc/bandit_pass/bandit24`
    

```bash
#!/bin/bash

cat /etc/bandit_pass/bandit24 > /tmp/pwned
```

```bash
cat /tmp/pwned
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773275126/1b336635-3b77-4298-bd1e-2bcbfd587f6d.png align="center")

```plaintext
🔒 VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar
```

# Level 24 -> Level 25:

* For this we need to call daemon at [localhost](http://localhost) at port 30002 with password of previous level and secret 4 digit pin
    
* First we generate the password and pin combination and brute force it to the service
    

```bash
#!/bin/bash

for i in {0..9}
do
  for j in {0..9}
  do
	for k in {0..9}
		do
			 for l in {0..9}
			 do
				echo  "VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar $i$j$k$l" >> pin.txt
			 done
		done
	done
done
```

```bash
for i in {0000..9999};do echo$i >> pin.txt ; done
```

* We then pipe the combination to the service and store response in a text file
    

```bash
cat pin.txt | nc localhost 30002 > response
```

* Now grep the password
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773321574/0930b9f4-2d4d-42dc-9702-6adc54b5f75a.png align="center")

```plaintext
🔒 p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d
```

# Level 25 -> Level 26:

* when logged in we get the private RSA key of user 26
    
* but the default shell is not bash or anything
    
* it is `/usr/bin/showtext`
    

```bash
#!/bin/sh

export TERM=linux

exec more ~/text.txt
exit 0
```

* The exec command shows the following result. The content is after "Enjoy you stay!".
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773385999/dbab11fa-d0de-44dd-a48c-0b216a925ccd.png align="center")

* Looking at the man page of the `more` command we figure we can go into `vim` while reading in more mode by pressing the `V` key .
    
* We then make our terminal so small that it automatically goes to more when showing the text in `*text.txt*` file.
    
* we then read file in vim by going to normal mode and entering the following command.
    

```plaintext
:r /etc/bandit_pass/bandit26
```

* We can also run shell commands or get shell from vim
    
* But for that we have to set the shell to bash as it has a different shell by default
    

```plaintext
:set shell=/bin/bash
:! cat /etc/bandit_pass/bandit26
:! /bin/bash
```

```plaintext
🔒 c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1
```

# Level 26 -> Level 27:

* We have a SUID binary by `bandit27` user which takes command as argument.
    

```bash
./bandit27-do cat /etc/bandit_pass/bandit27
```

```plaintext
🔒 YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS
```

# Level 27 -> Level 28:

* We first clone the repository in `/tmp` directory
    
* note that the port should be 2220
    

```bash
git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo
```

* Reading the `README` file in the repository which has the password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773422634/929003b7-3480-45a4-a90e-48b9ca3317c3.png align="center")

```plaintext
🔒 AVanL161y9rsbcJIsFHuw35rjaOM19nR
```

# Level 28 -> Level 29:

* Cloning the git repository we see the password is hidden
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773484216/e20d31ad-8553-467c-aaa5-2ddda517ba1b.png align="center")

* Since it is a git repository the changes are saved. Viewing git log
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773494500/f21a82bf-16a4-4b7d-beca-630b908c0c17.png align="center")

* the latest commit message indicates some credentials leak so we checkout to the previous commit.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773519438/bf6fa831-0248-4309-be33-21b6c6df4111.png align="center")

* Read the `Readme` file again
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773531901/5dbf0796-e2db-4a3a-b119-51f1107a2cb3.png align="center")

```plaintext
🔒 tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S
```

# Level 29 -> Level 30:

* The `readme` file shows no password
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773571258/4d103f4f-8df0-469c-a977-e6688ac1094d.png align="center")

* The log also do not have any information
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773586386/91cd0d91-7e36-452b-b08d-6f08a083826f.png align="center")

* But if we look at the branch in remote location we see some more branches
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773597111/1e180aeb-c288-4ca1-a648-a41c34e9688b.png align="center")

* If we observe the password field at the `readme`, it gives hint as not in the production
    

```bash
git checkout dev
```

* Then read the file again
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773634048/4b418a8d-f253-449f-a29a-14f9c87c66e3.png align="center")

```plaintext
🔒 xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS
```

# Level 30 -> Level 31:

* We do not find anything repeating the previous challenges
    
* But when we view tags it shows a file named `secret`
    

```bash
git tag
```

```bash
git show secret
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773658591/02ab5502-72e3-4eb2-9f34-25a9f6e28915.png align="center")

```plaintext
🔒 OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt
```

# Level 31 -> Level 32:

* Reading the `README` file we know the task to be performed
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773674235/8fd99066-d230-4fa1-b1ea-7e5c85cd1ae8.png align="center")

* creating the file with the content
    
* removing the file from the `.gitignore` and push them to remote repository we get the flag.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773689018/51fda5c3-373a-4a4c-b0b5-fdd65924e52a.png align="center")

```plaintext
🔒 rmCBvG56y58BXzv98yZGdO7ATVL5dW8y
```

# Level 32 -> Level 33:

* Upon ssh we get a shell where every command is converted to upper shell and then executed
    
* However environment variables like SHELL are accessible as they are in upper case.
    
* we execute $0 which represent the command which runs the program or binary.
    
* Eg. `/bin/bash uppershell` $0 represents /bin/bash and $1 represent `uppershell` which is the argument.
    
* We get the shell of `bandit33`
    
* on inspection we can see that `uppershell` is a binary with suid set to `bandit33` and group `bandit32` has the executable permission.
    
* From this we might guess, upon login through ssh `/bin/bash uppershell` command was executed.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722773730407/b505b040-1225-4b0e-ac0d-3c115850d03a.png align="center")

# Thank You !!!