Browse Category

General

OverTheWire: Bandit Level 19 to Level 20

bandit19_1

Level goal: To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used to setuid binary.

In this level, we will be working on a file which has its setuid set.

[email protected]:~$ file bandit20-do
bandit20-do: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=08e74b8e092a91103efaab7916d75f08b887ab4d, not stripped

It’s interesting because it allows us to run a command or do anything as bandit20.

[email protected]:~$ ./bandit20-do
Run a command as another user.
Example: ./bandit20-do id
[email protected]:~$ ./bandit20-do cat /etc/bandit_pass/bandit20
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

bandit19_2

The password to gain access to the next level is GbKksEFF4yrVs6il55v6gwY5aVje5f0j.

OverTheWire: Bandit Level 18 to Level 19

bandit18_1

Level goal: The password for the next level is stored in a file readme in the home directory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.

In this level, we need to connect using the ssh -t. The -t parameter basically opens a pseudo-tty within the session, with output in the same screen. The ssh session closes when the command completes. This way, you can quickly run a command before the connectivity closes and kicks you out with a “Byebye!”.

[email protected]:~$ ssh -t [email protected] cat readme
 The authenticity of host 'localhost (127.0.0.1)' can't be established.
 ECDSA key fingerprint is 05:3a:1c:25:35:0a:ed:2f:cd:87:1c:f6:fe:69:e4:f6.
 {... REMOVED ...}
 Permissions 0640 for '/home/bandit17/.ssh/id_rsa' are too open.
 It is required that your private key files are NOT accessible by others.
 This private key will be ignored.
 bad permissions: ignore key: /home/bandit17/.ssh/id_rsa
 [email protected]'s password:
 readme
 Connection to localhost closed.

Next, we run the same commands to check what is in the “readme” file.

[email protected]'s password:
IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x
Connection to localhost closed.

The password to gain access to the next level is IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x.

OverTheWire: Bandit Level 17 to Level 18

bandit17_1

Level goal: There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.newand is the only line that has been changed between passwords.old and passwords.new

NOTE: if you have solved this level and see ‘Byebye!’ when trying to log into bandit18, this is related to the next level, bandit19.

Here you see 2 password files. As the hint goes, New vs Old, the first thing to come to mind is to perform the diff function.

[email protected]:~$ diff passwords.new passwords.old
42c42
< kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd
---
> BS8bqB1kqkinKJjuxL6k072Qq9NRwQpR

The password is kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd. To verify whether this is the correct password, we will follow the hint, which is to try to connect to bandit18 and see if we see the “Byebye!” message.

bandit17_2

The password to gain access to the next level is kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd.

OverTheWire: Bandit Level 16 to Level 17

bandit16_1

Level goal: The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it

This level require us to have basic understanding in port scanning and identifying the services. First, let’s perform a port scan to identify the open ports between the range of 31000 to 32000.

[email protected]:~$ nmap localhost -p31000-32000

Starting Nmap 6.40 ( http://nmap.org ) at 2016-09-10 14:17 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00088s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
31046/tcp open unknown
31518/tcp open unknown
31691/tcp open unknown
31790/tcp open unknown
31960/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds

Now there we have shortlisted only 5 ports with services, we will test if it is configured to accept normal connectivity or restricted to only SSL connectivity. For instance, we can do it using the following command,

[email protected]:~$ echo test | nc -v localhost 31046
Connection to localhost 31046 port [tcp/*] succeeded!
test

We see that port 31046 is able to accept non-SSL connection, which means that this is not our target. Let’s check out the other 4 ports as well.

bandit16_2

Now, we will focus on the 2 ports which produced error output because they are configured to restrict connectivity to SSL only. We will now try to connect using openssl with s_client option, to check if there is any correct output.

[email protected]:~$ echo cluFn7wTiGryunymYOu4RcffSxQluehd | openssl s_client -quiet -connect localhost:31790
depth=0 CN = li190-250.members.linode.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = li190-250.members.linode.com
verify return:1
Correct!
{ ... RSA PRIVATE KEY ... }

bandit16_3

The private key for accessing the next level is stored in port 31790! Now, I have to save this RSA private key into a file and then use it to connect to the next level.

After you’re done with the “copy and paste”, try to connect, you should encounter an error message, which is a good learning point with regards to RSA keys permissions,

bandit16_5

The fix is very simple, simply modify the file permission and set it as 400 and you are good to go!

bandit16_6

bandit16_7

There you go, you are in!

OverTheWire: Bandit Level 15 to Level 16

bandit15_1

Level goal: The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…

In this level, we connect to the port 30001 on localhost using the SSL encryption. We can do it using the openssl command.

[email protected]:~$ openssl s_client -quiet -connect 127.0.0.1:30001
depth=0 CN = li190-250.members.linode.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = li190-250.members.linode.com
verify return:1
BfMYroe26WYalil77FoDi9qh59eK5xNr
Correct!
cluFn7wTiGryunymYOu4RcffSxQluehd

read:errno=0

The password to gain access to the next level is cluFn7wTiGryunymYOu4RcffSxQluehd.