Bandit Level 0
The goal of this level is for you to log into the game using SSH. The host to which you need to connect isbandit.labs.overthewire.org, on port 2220. The username is bandit0and the password is bandit0. Once logged in, go to the Level 1page to find out how to beat Level 1.
◼sshでサーバにに接続 サーバ名：bandit.labs.overthewire.org / ログイン名：bandit0 / パスワード：bandit0
% ssh bandit0@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit0@bandit.labs.overthewire.org's password: bandit0
Bandit Level 0 → Level 1
The password for the next level is stored in a file calledreadmelocated in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.
◼readmeファイルを表示
bandit0@bandit:~$ ls -l
total 4
-rw-r----- 1 bandit1 bandit0 33 Dec 28 14:34 readme
bandit0@bandit:~$ cat readme
boJ9jbbUNNfktd78OOpsqOltutMc3MY1
Bandit Level 1 → Level 2
The password for the next level is stored in a file called -located in the home directory
◼"-"ファイルを表示
bandit1@bandit:~$ ls -l
total 4
-rw-r----- 1 bandit2 bandit1 33 Dec 28 14:34 -
bandit1@bandit:~$ cat ./-
CV1DtqXWVFXTvM2F0k09SHz0YwRINYA9
Bandit Level 2 → Level 3
The password for the next level is stored in a file called spaces in this filenamelocated in the home directory
◼スペースの有るファイル名を指定し表示
bandit2@bandit:~$ ls -l
total 4
-rw-r----- 1 bandit3 bandit2 33 Dec 28 14:34 spaces in this filename
bandit2@bandit:~$ cat "spaces in this filename"
UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK
Bandit Level 3 → Level 4
The password for the next level is stored in a hidden file in theinheredirectory.
◼"."で始まるファイル名を指定し表示
bandit3@bandit:~$ ls -la inhere/
total 12
drwxr-xr-x 2 root root 4096 Dec 28 14:34 .
drwxr-xr-x 3 root root 4096 Dec 28 14:34 ..
-rw-r----- 1 bandit4 bandit3 33 Dec 28 14:34 .hidden
bandit3@bandit:~$ cat inhere/.hidden
pIwrPrtPN36QITSp3EQaw936yaFoFgAB
Bandit Level 4 → Level 5
The password for the next level is stored in the only human-readable file in the inheredirectory. Tip: if your terminal is messed up, try the “reset” command.
◼human-readable file を探してファイルを表示
bandit4@bandit:~$ ls -l
total 4
drwxr-xr-x 2 root root 4096 Dec 28 14:34 inhere
bandit4@bandit:~$ ls -l inhere/
total 40
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file00
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file01
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file02
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file03
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file04
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file05
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file06
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file07
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file08
-rw-r----- 1 bandit5 bandit4 33 Dec 28 14:34 -file09
bandit4@bandit:~$ file inhere/-file0*
inhere/-file00: data
inhere/-file01: data
inhere/-file02: data
inhere/-file03: data
inhere/-file04: data
inhere/-file05: data
inhere/-file06: data
inhere/-file07: ASCII text
inhere/-file08: data
inhere/-file09: data
bandit4@bandit:~$ cat inhere/-file07
koReBOKuIDDepwhWk7jZC0RTdopnAYKh
Bandit Level 5 → Level 6
The password for the next level is stored in a file somewhere under the inheredirectory and has all of the following properties:
- human-readable
- 1033 bytes in size
- not executable
◼inhereディレクト配下で1033bytesのファイルを検索し表示
bandit5@bandit:~$ find inhere/ -size 1033c
inhere/maybehere07/.file2
bandit5@bandit:~$ cat inhere/maybehere07/.file2
DXjZPULLxYr17uwoI01bNLQbtFemEgo7
Bandit Level 6 → Level 7
The password for the next level is stored somewhere on the serverand has all of the following properties:
- owned by user bandit7
- owned by group bandit6
- 33 bytes in size
◼全ディレクトリから user:bandit7 / group:bandit6 / size:33bytsを検索し表示
bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c | grep bandit7
find: '/etc/ssl/private': Permission denied
find: '/etc/polkit-1/localauthority': Permission denied
find: '/run/lxcfs': Permission denied
find: '/run/user/11002': Permission denied
find: '/run/user/11019': Permission denied
find: '/run/user/11004': Permission denied
find: '/run/user/11021': Permission denied
find: '/run/user/11008': Permission denied
find: '/run/user/11001': Permission denied
find: '/run/user/11010': Permission denied
find: '/run/user/11023': Permission denied
find: '/run/user/11024': Permission denied
find: '/run/user/11012': Permission denied
find: '/run/user/11022': Permission denied
find: '/run/user/11020': Permission denied
find: '/run/user/11015': Permission denied
find: '/run/user/11025': Permission denied
find: '/run/user/11016': Permission denied
find: '/run/user/11014': Permission denied
find: '/run/user/11011': Permission denied
find: '/run/user/11017': Permission denied
find: '/run/user/11013': Permission denied
find: '/run/user/11000': Permission denied
find: '/run/user/11005': Permission denied
find: '/run/sudo': Permission denied
find: '/run/log/journal/0d8e66480c320675a338622759f86ace': Permission denied
find: '/run/lvm': Permission denied
find: '/run/systemd/inaccessible': Permission denied
find: '/run/lock/lvm': Permission denied
find: '/dev/mqueue': Permission denied
find: '/dev/shm': Permission denied
find: '/lost+found': Permission denied
find: '/root': Permission denied
find: '/opt/splunkforwarder/etc/auth': Permission denied
find: '/opt/splunkforwarder/etc/apps/learned/local': Permission denied
find: '/opt/splunkforwarder/var': Permission denied
find: '/home/bandit5/inhere': Permission denied
find: '/var/log': Permission denied
find: '/var/lib/puppet': Permission denied
find: '/var/lib/apt/lists/partial': Permission denied
/var/lib/dpkg/info/bandit7.password
find: '/var/lib/polkit-1': Permission denied
find: '/var/spool/rsyslog': Permission denied
find: '/var/spool/bandit24': Permission denied
find: '/var/spool/cron/atspool': Permission denied
find: '/var/spool/cron/atjobs': Permission denied
find: '/var/spool/cron/crontabs': Permission denied
find: '/var/crash': Permission denied
find: '/var/tmp': Permission denied
find: '/var/cache/apt/archives/partial': Permission denied
find: '/var/cache/ldconfig': Permission denied
find: '/tmp': Permission denied
find: '/sys/fs/fuse/connections/39': Permission denied
find: '/sys/kernel/debug': Permission denied
find: '/proc/tty/driver': Permission denied
find: '/proc/31197/task/31197/fd/6': No such file or directory
find: '/proc/31197/task/31197/fdinfo/6': No such file or directory
find: '/proc/31197/fd/5': No such file or directory
find: '/proc/31197/fdinfo/5': No such file or directory
bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs
Bandit Level 7 → Level 8
The password for the next level is stored in the file data.txtnext to the word millionth
◼word:"millionth"をdata.txtから検索
bandit7@bandit:~$ grep millionth data.txt
millionth cvX2JJa4CFALtqS87jk27qwqGhBM9plV
Bandit Level 8 → Level 9
The password for the next level is stored in the file data.txtand is the only line of text that occurs only once
◼１回だけ出現するテキスト行を表示
bandit8@bandit:~$ sort data.txt | uniq -u
UsvVyFSfZZWbi6wgC7dAFyFuR6jQQUhR
Bandit Level 9 → Level 10
The password for the next level is stored in the file data.txtin one of the few human-readable strings, beginning with several ‘=’ characters.
◼human-readable で"="で始まる
bandit9@bandit:~$ strings data.txt | grep "^="
=-VW+
========== theP`
========== password
========== truKLdjsbJ5g7yyJ2X2R0o3a5HQJFuLk
Bandit Level 10 → Level 11
The password for the next level is stored in the file data.txt, which contains base64 encoded data
bandit10@bandit:~$ base64 -d data.txt
The password is
Bandit Level 11 → Level 12
The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions
◼ROT13(シーザ暗号)を解く
bandit11@bandit:~$ cat data.txt
Gur cnffjbeq vf 5Gr8L4qetPEsPk8htqjhRK8XSP6x2RHh
bandit11@bandit:~$ python3
Python 3.5.2 (default, Nov 23 2017, 16:37:01)
Type "help", "copyright", "credits" or "license" for more information.
>>> import codecs
>>> codecs.decode('Gur cnffjbeq vf 5Gr8L4qetPEsPk8htqjhRK8XSP6x2RHh', 'rot13')
'The password is 5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu'
Bandit Level 12 → Level 13
The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!)
◼繰り返し圧縮された16進ダンプされたファイルを変換、解凍
*xxd -r ：16進ﾀﾞﾝﾌﾟからﾊﾞｲﾅﾘ形式に変換
*file：形式を確認
*mv：でﾌｧｲﾙ名を変更する
*gzip / bzip2 / tar / bz2 圧縮・解凍
bandit12@bandit:~$ mkdir/tmp/pass
bandit12@bandit:~$ cp -p data.txt /tmp/pass/data.txt
bandit12@bandit:~$ cd /tmp/pass
bandit12@bandit:/tmp/pass$ ls -l
total 4
-rw-r----- 1 bandit12 bandit12 2646 Dec 28 14:34 data.txt
bandit12@bandit:/tmp/pass$ xxd -r data.txt > data1
bandit12@bandit:/tmp/pass$ ls
data.txt data1
bandit12@bandit:/tmp/pass$ file data1
data1: gzip compressed data, was "data2.bin", last modified: Thu Dec 28 13:34:36 2017, max compression, from Unix
bandit12@bandit:/tmp/pass$ mv data1 data1.gz
bandit12@bandit:/tmp/pass$ gzip -d data1.gz
bandit12@bandit:/tmp/pass$ ls
data.txt data1
bandit12@bandit:/tmp/pass$ file data1
data1: bzip2 compressed data, block size = 900k
bandit12@bandit:/tmp/pass$ ls -l
total 8
-rw-r----- 1 bandit12 bandit12 2646 Dec 28 14:34 data.txt
-rw-rw-r-- 1 bandit12 bandit12 585 May 21 15:16 data1.gz2
bandit12@bandit:/tmp/pass$ bzip2 -d data1.gz2
bzip2: Can't guess original name for data1.gz2 -- using data1.gz2.out
bandit12@bandit:/tmp/pass$ ls
data.txt data1.gz2.out
bandit12@bandit:/tmp/pass$ mv data4.gzip data4.gz
bandit12@bandit:/tmp/pass$ ls
data.txt data4.gz
bandit12@bandit:/tmp/pass$ gzip -d data4.gz
bandit12@bandit:/tmp/pass$ ls
data.txt data4
bandit12@bandit:/tmp/pass$ file data4
data4: POSIX tar archive (GNU)
bandit12@bandit:/tmp/pass$ mv data4 data4.tar
bandit12@bandit:/tmp/pass$ tar -xvf data4.tar
data5.bin
bandit12@bandit:/tmp/pass$ file data5.bin
data5.bin: POSIX tar archive (GNU)
bandit12@bandit:/tmp/pass$ mv data5.bin data5.tar
bandit12@bandit:/tmp/pass$ tar -xvf data5.tar
data6.bin
bandit12@bandit:/tmp/pass$ file data6.bin
data6.bin: bzip2 compressed data, block size = 900k
bandit12@bandit:/tmp/pass$ mv data6.bin data6.bz2
bandit12@bandit:/tmp/pass$ bzip2 -d data6.bz2
bandit12@bandit:/tmp/pass$ ls
data.txt data4.tar data5.tar data6
bandit12@bandit:/tmp/pass$ file data6
data6: POSIX tar archive (GNU)
bandit12@bandit:/tmp/pass$ mv data6 data6.tar
bandit12@bandit:/tmp/pass$ tar -xvf data6.tar
data8.bin
bandit12@bandit:/tmp/pass$ file data8.bin
data8.bin: gzip compressed data, was "data9.bin", last modified: Thu Dec 28 13:34:36 2017, max compression, from Unix
bandit12@bandit:/tmp/pass$ mv data8.bin data8.gz
bandit12@bandit:/tmp/pass$ gzip -d data8.gz
bandit12@bandit:/tmp/pass$ ls
data.txt data4.tar data5.tar data6.tar data8
bandit12@bandit:/tmp/pass$ file data8
data8: ASCII text
bandit12@bandit:/tmp/pass$ cat data8
The password is 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL
Bandit Level 13 → Level 14
The password for the next level is stored in/etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level.Note:localhostis a hostname that refers to the machine you are working on
◼sshコマンド -iオプション:接続に使用する公開鍵ファイルを指定する
bandit13@bandit:~$ ssh -i sshkey.private bandit14@localhost
bandit14@bandit:~$ cat /etc/bandit_pass/bandit14
4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e
Bandit Level 14 → Level 15
The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.
◼対象ホストに対しポートを指定して、クライアントと疎通確認
bandit14@bandit:~$ nc localhost 30000 < /etc/bandit_pass/bandit14
Correct!
BfMYroe26WYalil77FoDi9qh59eK5xNr
Bandit Level 15 → Level 16
The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhostusing SSL encryption.
Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…
◼SSLで指定サーバに接続 openssl s_client:sslで指定サーバに接続 / -connect:サーバへ接続 / -quiet:SSL/TLSを省略し、HTTPリクエスト・レスポンスを中心に見る セッションと認証情報の表示を抑止する
bandit15@bandit:~$ cat /etc/bandit_pass/bandit15 | openssl s_client -quiet -connect localhost:30001
depth=0 CN = bandit
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = bandit
verify return:1
Correct!
cluFn7wTiGryunymYOu4RcffSxQluehd
Bandit Level 16 → Level 17
The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.
◼サーバの空きポートを探し、SSL接続可能なポートを探す
bandit16@bandit:~$ nmap -p 31000-32000 localhost
Starting Nmap 7.01 ( https://nmap.org ) at 2018-05-21 15:37 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 996 closed ports
PORT STATE SERVICE
31046/tcp open unknown
31518/tcp open unknown
31691/tcp open unknown
31790/tcp open unknown
31960/tcp open unknown
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | nc localhost 31046
cluFn7wTiGryunymYOu4RcffSxQluehd
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | nc localhost 31518
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | nc localhost 31691
cluFn7wTiGryunymYOu4RcffSxQluehd
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | nc localhost 31790
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | nc localhost 31960
cluFn7wTiGryunymYOu4RcffSxQluehd
bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | openssl s_client -quiet -connect localhost:31790 > /tmp/key/bandit16key
depth=0 CN = bandit
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = bandit
verify return:1
bandit16@bandit:~$ cat /tmp/key/bandit16key
Correct!
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----
bandit16@bandit:~$ ls -l /tmp/key
total 4
-rw-rw-r-- 1 bandit16 bandit16 1685 May 21 15:47 bandit16key
bandit16@bandit:~$ chmod 600 /tmp/key/bandit16key
bandit16@bandit:~$ ls -l /tmp/key
total 4
-rw------- 1 bandit16 bandit16 1685 May 21 15:47 bandit16key
bandit16@bandit:~$ ssh -i /tmp/key/bandit16key bandit17@localhost
bandit17@bandit:~$ cat /etc/bandit_pass/bandit17
xLYVMN9WE5zQ5vHacb0sZEVqbrp7nBTn
Bandit Level 17 → Level 18
There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is inpasswords.newand is the only line that has been changed betweenpasswords.old and passwords.new
◼2つのファイルの違うところを探す
bandit17@bandit:~$ ls
passwords.new passwords.old
bandit17@bandit:~$ diff passwords.new passwords.old
42c42
< kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd
---
> 6vcSC74ROI95NqkKaeEC2ABVMDX9TyUr
bandit17@bandit:~$
Bandit Level 18 → Level 19
The password for the next level is stored in a file readmein the homedirectory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.
◼Login後直ぐに、Log Outさせられるので、Loginnと同時に"readme"ファイルを表示
% ssh bandit18@bandit.labs.overthewire.org -p 2220 cat readme
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit18@bandit.labs.overthewire.org's password:
IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x
Bandit Level 19 → Level 20
To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.
■実行ファイルを実行、”Example: ./bandit20-do id"実行時引数が必要なようなので、、iパスワードを引数にし実行
bandit19@bandit:~$ file bandit20-do
bandit20-do: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c05d80e62cd205a3497b870e8294402424a4f7c, not stripped
bandit19@bandit:~$ ./bandit20-do
Run a command as another user.
Example: ./bandit20-do id
bandit19@bandit:~$ ./bandit20-do cat /etc/bandit_pass/bandit20
GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Bandit Level 20 → Level 21
There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21).
■実行ファイルを確認。実行してみる。ローカルホストに適当なポートで接続し、パスワードを読み込ませる。同ポートで実行ファイルを実行し、パスワードを比較して正しければ次のパスワードが表示される。
bandit20@bandit:~$ ls -l
total 8
-rwsr-x--- 1 bandit21 bandit20 8044 Dec 28 14:34 suconnect
bandit20@bandit:~$ file suconnect
suconnect: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=4039bf634dd9dbc0a432b05c2af97658f2f59614, not stripped
bandit20@bandit:~$ ./suconnect
Usage: ./suconnect <portnumber>
This program will connect to the given port on localhost using TCP. If it receives the correct password from the other side, the next password is transmitted back.
bandit20@bandit:~$ nc -l 8000 < /etc/bandit_pass/bandit20 &
[1] 30692
bandit20@bandit:~$ ./suconnect 8000
Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Password matches, sending next password
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr
Bandit Level 21 → Level 22
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.
■"/etc/cron.d/"配下のファイルを確認。"/usr/bin/cronjob_bandit22.sh"内を確認。パスワードが書き込まれるファイルを表示。
bandit21@bandit:~$ ls -l /etc/cron.d
total 16
-rw-r--r-- 1 root root 120 Dec 28 14:34 cronjob_bandit22
-rw-r--r-- 1 root root 122 Dec 28 14:34 cronjob_bandit23
-rw-r--r-- 1 root root 120 Dec 28 14:34 cronjob_bandit24
-rw-r--r-- 1 root root 190 Oct 31 2017 popularity-contest
bandit21@bandit:~$ cat /etc/cron.d/*
@reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
@reboot bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null
@reboot bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null
* * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
4 22 * * * root test -x /etc/cron.daily/popularity-contest && /etc/cron.daily/popularity-contest --crond
bandit21@bandit:~$ cat /usr/bin/cronjob_bandit22.sh
#!/bin/bash
chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
bandit21@bandit:~$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI
Bandit Level 22 → Level 23
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.
NOTE: Looking at shell scripts written by other people is a very useful skill. The script for this level is intentionally made easy to read. If you are having problems understanding what it does, try executing it to see the debug information it prints.
■"/etc/cron.d"内のbandit23ファイルから該当シェルを確認し、内容を確認、実行。表示されたターゲット名のファイルを確認
bandit22@bandit:~$ ls -l /etc/cron.d
total 16
-rw-r--r-- 1 root root 120 Dec 28 14:34 cronjob_bandit22
-rw-r--r-- 1 root root 122 Dec 28 14:34 cronjob_bandit23
-rw-r--r-- 1 root root 120 Dec 28 14:34 cronjob_bandit24
-rw-r--r-- 1 root root 190 Oct 31 2017 popularity-contest
bandit22@bandit:~$ cat /etc/cron.d/cronjob_bandit23
@reboot bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null
bandit22@bandit:~$ cat /usr/bin/cronjob_bandit23.sh
#!/bin/bash
myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget
bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1
8ca319486bfbbc3663ea0fbe81326349
bandit22@bandit:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349
jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n
Bandit Level 23 → Level 24
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.
NOTE: This level requires you to create your own first shell-script. This is a very big step and you should be proud of yourself when you beat this level!
NOTE 2: Keep in mind that your shell script is removed once executed, so you may want to keep a copy around…