Skip to main content

Bandit 13 Over The Wire

Lessons Learned

using ssh -i filename user@localhost which is the private key ssh connection

Logging in

On a kali vm/ linux machine
Type:

ssh bandit13@bandit.labs.overthewire.org -p 2220
8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL

Completing The Challenge

The Goal:

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on

The Solution:

  • ssh -i sshkey.private bandit14@localhost

the above command is use because we already have the private key. private keys should be used very carefully. Since we are already on the machine that hosts Bandit Over The Wire, we don't need to call the correct name, localhost will means the machine talks to itself. I don't know why, but specifying a port here caused issues. My assumption is the profiles is listening for connections on port 22 not port 2220 at least internally/private key connections

  •  type yes and ENTER when prompted

after verifying you are bandit14:

  • cat /etc/bandit_pass/bandit14
  • 4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e

Labels:

Comments

Post a Comment

Popular posts from this blog

Bandit 12 Over The Wire

Lessons Learned extracting and decompressing files using the following tools: file, xxd -r, gunzip, bunsip2, and tar -xf Logging in On a kali vm/ linux machine Type: ssh bandit12@bandit.labs.overthewire.org -p 2220  5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu Completing The Challenge The Goal: The password for the next level is stored in the file data.txt , which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!) The Solution:      Revamped:         I decided to write a bash file that solves the problem.                    mkdir /tmp/a_name/                    mv data.txt /tmp/a_name      ...
Post a Comment
Read more

Bandit 23 Over The Wire

Lessons Learned understanding more complicated bash scripts and writing bash scripts to take advantage of automated processes Logging in On a kali vm/ linux machine Type: ssh bandit23@bandit.labs.overthewire.org -p 2220 jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n  Completing The Challenge The Goal: A program is running automatically at regular intervals from cron , the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed. The Solution: bandit23@bandit:~$ cat /etc/cron.d/cronjob_bandit24 @reboot bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null * * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null bandit23@bandit:~$ cat /usr/bin/cronjob_bandit24.sh #!/bin/bash myname=$(whoami) cd /var/spool/$myname echo "Executing and deleting all scripts in /var/spool/$myname:" for i in * .*; do     if [ "$i" != "." -a "$i" != ".." ];     then         echo "Handling $i...
Post a Comment
Read more

Bandit 22 Over the Wire

Lessons Learned understanding more complicated bash scripts Logging in On a kali vm/ linux machine Type: ssh bandit22@bandit.labs.overthewire.org -p 2220 Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI Completing The Challenge The Goal: A program is running automatically at regular intervals from cron , the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed. The Solution: bandit22@bandit:~$ ls /etc/cron cron.d/       cron.hourly/  crontab        cron.daily/   cron.monthly/ cron.weekly/   bandit22@bandit:~$ ls /etc/cron cron.d/       cron.hourly/  crontab        cron.daily/   cron.monthly/ cron.weekly/   bandit22@bandit:~$ ls /etc/cron.d/ cronjob_bandit15_root  cronjob_bandit22  cronjob_bandit24 cronjob_bandit17_root  cronjob_bandit23  cronjob_bandit25_root bandit22@ba...
Post a Comment
Read more