Sws101_journal1
Topic : Bandit Wargame on OverTheWire.org
For a brief introduction, this Bandit wargame is ike most other games, is organised in levels. You start at Level 0 and try to “beat” or “finish” it. Finishing a level results in information on how to start the next level. The pages on this website for “Level
E.g. The page for Level 1 has information on how to gain access from Level 0 to Level 1. All levels in this game have a page on this website, and they are all linked to from the sidemenu on the left of this page.
Level 0-1
- use SSH (learn what and how)
- log into the game using ssh bwith host bandit.labs.overthewire.org, on port 2220. (this continues similarly to all higher levels)
ssh bandit0@bandit.labs.overthewire.org -p 2220
- for now, username and password will be bandit0
- use ls -al (list all files without leaving out hidden ones)
- following the instructions, there is a readme which we are supposed to concatenate or display by using:
cat readme
Get the password. We essentially get these flags or strings which are going to be the password for the next level.
Level 1-2
- password stored in - file
- ls -al
- cat - (doesn’t work, - acts as a special character)
cat ./-
This ensure that cat interprets “-“ as the name of the file I want to display, rather than as a special character or option.
Get password.
Level 2-3
- password stored in ‘spaces in this filename’
- ls -al
- cat spaces in this filename(doesn’t work)
cat “spaces in this filename”
This handle filenames with spaces, ensuring that cat interprets the entire filename as a single argument.
Get password.
Level 3-4
Level 4-5
- password stored in the only human-readable file in the inhere directory.
- ls -al
- cd inhere/
- ls
find . -type f | xargs file
This is used to find all regular files (not directories or other types of files) in the current directory (.) and its subdirectories. Then, it passes the list of files found to the file command via xargs. The file command is used to determine the type of a file based on its content.
man xargs
This will display the manual page for xargs, providing information on its usage, options, and examples.
cat ./-file07
Display content of ./-file07
Get password.
Level 5-6
- The password for the next level is stored in a file somewhere under the inhere directory and has some properties
- ls
- cd inhere/
find . -type f -size 1033c ! -executable
This will search for regular files (-type f) in the current directory and its subdirectories (.) that have a size of exactly 1033 bytes (-size 1033c) and are not executable (! -executable).
cat ./maybehere07/.file2
Then we ‘cat’ whatever output we got from above.
Get password.
Level 6-7
- The password for the next level is stored in a file somewhere under the inhere directory and has some properties
find / -type f -user bandit7 -group bandit6 -size 33c
This will search the entire filesystem (/) for regular files (-type f) that are owned by the user bandit7, belong to the group bandit6, and have a size of exactly 33 bytes (-size 33c).
- search the file with the password
- cat the file
Get password.
Level 7-8
- The password for the next level is stored in the file data.txt next to the word millionth
- ls(straightaway shows the data.txt file)
- strings data.txt(cat all the files but sorted)
strings data.txt | grep “millionth”
This uses strings to extract printable strings from the file data.txt, then using grep to search for lines containing the string “millionth”.
Get password.
Level 8-9
- The password for the next level is stored in the file data.txt and is the only line of text that occurs only once
- cat data.txt(unsorted duplicates with one unique string)
man uniq
man: displays the manual page for a command.
uniq: filters out repeated lines in a file.
sort data.txt | uniq -c
This sorts the lines in the file data.txt, then uses uniq -c to count the occurrences of each unique line.
Get password from the one line with the unique string.
Level 9-10
- The password for the next level is stored in the file data.txt in one of the few human-readable strings, preceded by several ‘=’ characters.
strings data.txt | grep “=”
This will extract printable strings from the file data.txt using the strings command, and then filter those strings to only display lines containing the character “=” using grep.
Get password.
Level 10-11
- The password for the next level is stored in the file data.txt, which contains base64 encoded data
man base64
Display manual page for base64
base64 -d data.txt
This will decode the contents of the file data.txt and print the original data to the terminal. Make sure you are in the directory where the file data.txt is located, or provide the full path to the file if it’s located elsewhere.
Get password.
Level 11-12
- The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions
- cat data.txt
- For this level, we have to decrypt the ROT13
- I used cyberchef for decrypting the ROT13
Get password.
Level 12-13
The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed.
Initial Setup
Created a temporary directory /tmp/pema.
mkdir /tmp/pema
Copy Data
Copied data.txt into the /tmp/pema directory.
cp data.txt /tmp/pema
Convert Hexadecimal to Binary
Converted hexadecimal representation of data in data.txt into binary.
xxd -r data.txt > data
Identify Compression Format
Identified that data is in gzip format.
file data
Decompress Gzip File
Decompressed data which was in gzip format.
mv data file.gz
gzip -d file.gz
Identify Compression Format
Identified that file is in bzip2 format.
file file
Decompress Bzip2 File
Decompressed file which was in bzip2 format.
mv file file.bz2
bzip2 -d file.bz2
Identify Compression Format
Identified that file is in gzip format.
file file
Decompress Gzip File
Decompressed file which was in gzip format.
mv file file.gz
gzip -d file.gz
Identify Tar Archive
Identified that file is a tar archive.
file file
Extract Tar Archive
Extracted the contents of the tar archive file.tar.
mv file file.tar
tar xf file.tar
Identify Compression Format
Identified that data5.bin is in gzip format.
file data5.bin
Rename and Extract Tar Archive
Renamed and extracted the contents of the nested tar archive data5.bin.
mv data5.bin data.tar
tar xf data.tar
Identify Compression Format
Identified that data6.bin is in bzip2 format.
file data6.bin
Decompress Bzip2 File
Decompressed data6.bin which was in bzip2 format.
mv data6.bin data.bz2
bzip2 -d data.bz2
Identify Tar Archive
Identified that data is a tar archive.
file data
Extract Tar Archive
Extracted the contents of the tar archive data.tar.
tar xf data.tar
Identify Compression Format
Identified that data8.bin is in gzip format.
file data8.bin
Decompress Gzip File: Decompressed data8.bin which was in gzip format.
mv data8.bin datagz
gzip -d datagz
Identify Content
Identified that data contains the password for the next level.
cat data
Level 13-14
- ls
- cat sshkey.private(from ls) Copy the data -exit from bandit13@bandit
- echo “(paste the copied data)” > private.key
This will create a new private key file in my desktop.
chmod 700 private,key
I changed the permissions of the private.key file to 700 so that only the owner (me) has reading, writing, and executing permissions, while all other users on the system have no access.
ssh bandit14@bandit.labs.overthewire.org -p 2220 -i private.key
This will establish an SSH connection to the server ‘bandit.labs.overthewire.org’ on port ‘2220’ using the private key file named ‘private.key’. The ‘-i’ flag specifies the identity (private key) file to use for authentication. After running above command it establishes ssh connection to my server and sends me to bandit14@bandit.
cat /etc/bandit_pass/bandit14
From the instructions.
Level 14-15
- The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.
nc
This is the command for netcat, a utility used for reading from and writing to network connections.
On bandit14@bandit itself we command
nc localhost 30000
and paste the password we got from bandit14@bandit by cat /etc/bandit_pass/bandit14
Get password.
Level 15-16
- The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.
man ncat | grep ssl
This command searches the manual page of ncat for any references to SSL.
ncat –ssl localhost 30001
and the ‘password’ i got for level 15. This command attempts to establish an SSL/TLS encrypted connection to the localhost on port 30001 using ncat.
Get password.
Level 16-17
nmap localhost -p 31000-32000
scans ports 31000 to 32000 on the localhost
ncat –ssl localhost 31790
connected to port 31790 on localhost using SSL with ncat
vim key
chmod 400 key
created a file named “key” using the vim text editor to store the RSA private key. Afterwards changed the permissions of the “key” file to make it readable only by the owner.
ssh -i key bandit17@bandit.labs.overthewire.org -p 2220
attempted to SSH into Bandit17 using the private key stored in the “key” file.
Level 17-18
diff passwords.old passwords.new
This will display the lines that are different between the two files.
- Since there seems to be only one change updated, it takes one try and the password is correct.
Level 18-19
ssh -t bandit18@bandit.labs.overthewire.org -p 2220 /bin/sh
-t: Allocates a pseudo-terminal. /bin/sh: Starts a shell session on the remote server.
- then enter the password i got earlier when i did ‘diff’
- ls
- cat readme
Get password.
Level 19-20
./bandit20-do
This runs the ‘bandit20-do’ binary. It displayed the usage instructions, explaining how to use it.
./bandit20-do ls
This runs the ls command as the user specified by bandit20-do.
./bandit20-do cat /etc/bandit_pass/bandit20
cat command as the user specified by bandit20-do, allows to read the contents of the /etc/bandit_pass/bandit20 file.
Get password.
Level 20-21
- ls
- to execute suconnect
./suconnect
the server answers;
[./suconnect portnumber This program will connect to the given port on localhost using TCP. If it receives the correct password from the other side, the next password is transmitted back.]
So I open another terminal with the bandit20@bandit logged in and start listening on a random port number.
nc -lvp 9999
Then back to the previous terminal, i type command
./suconnect 9999
Then back to my new terminal, I copy and pasted the bandit20 password and press enter, my passwords match in the first terminal and it sends back a ‘new password’ in the new terminal.
Get password to bandit21@bandit.
Conclusion
From this activity, I have successfully navigated through various challenges, demonstrating proficiency in using command-line tools and techniques such as SSH, netcat (nc), permissions management, file manipulation, and system exploration. Additionally, I encountered situations where they needed to escalate privileges or execute commands with elevated permissions, showcasing problem-solving skills in a simulated environment.