Skip to main content

Bandit 20 Over The Wire

Lessons Learned

using nc to create a steady connection, also on background and foreground processes

Logging in


On a kali vm/ linux machine
Type:

ssh bandit20@bandit.labs.overthewire.org -p 2220
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

Completing The Challenge

The Goal:

There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21).

The Solution:

bandit20@bandit:~$ nc -l -p 2000
^Z
[1]+  Stopped                 nc -l -p 2000
bandit20@bandit:~$ ./suconnect 2000
^Z
[2]+  Stopped                 ./suconnect 2000
bandit20@bandit:~$ fg 1
nc -l -p 2000
GbKksEFF4yrVs6il55v6gwY5aVje5f0j
^Z
[1]+  Stopped                 nc -l -p 2000
bandit20@bandit:~$ fg 2
./suconnect 2000
Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Password matches, sending next password
bandit20@bandit:~$ fg1
-bash: fg1: command not found
bandit20@bandit:~$ fg 1
nc -l -p 2000
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr


this took me some time since i kept wanting to use the -c but that sends one message and closes, it wasn't till i read https://www.computerhope.com/unix/nc.htm that i understood that "nc -l -p port" creates an active connection that wont actively close after the first message and can be used to keep sending and receiving messages.

Labels:

Comments

Post a Comment

Popular posts from this blog

Bandit 13 Over The Wire

Lessons Learned using ssh -i filename user@localhost which is the private key ssh connection Logging in On a kali vm/ linux machine Type: ssh bandit13@bandit.labs.overthewire.org -p 2220 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL Completing The Challenge The Goal: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14 . For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on The Solution: ssh -i sshkey.private bandit14@localhost the above command is use because we already have the private key. private keys should be used very carefully. Since we are already on the machine that hosts Bandit Over The Wire, we don't need to call the correct name, localhost will means the machine talks to itself. I don't know why, but specifying a port here caused issues. My assumption is the profiles is listeni...
Post a Comment
Read more

Bandit 6 Over The Wire

Lessons learned Find has modifiers for user, group, size, and can execute a command on find files Logging into Bandit 6 On a kali vm/ linux machine Type: ssh bandit6@bandit.labs.overthewire.org -p 2220  DXjZPULLxYr17uwoI01bNLQbtFemEgo7 Completing The Challenge The Goal: password for next level located in a file somewhere in the server and has all of the following properties: owned by user bandit7 owned by group bandit6 33 bytes in size The Solution: bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c 2>/dev/null  /var/lib/dpkg/info/bandit7.password bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c 2>/dev/null -exec cat {} + HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs using what we learned previously we know how to get size an easy way to look for modifiers if you already have an idea of what your looking for is to do:   man CMD | grep MOD this pipes/lets grep read the output of the man page and then look for certain strings in this case i looked ...
Post a Comment
Read more

Bandit 0 Over The Wire

Lessons learned: cat to read files Logging into Bandit 0 On a kali vm/ linux machine Type: ssh bandit0@bandit.labs.overthewire.org -p 2220 yes bandit0 Or: ssh bandit0@bandit.labs.overthewire.org -p 2220 bandit0 Completing Challenge 0 The Goal: password for next level located in a file called readme in the home directory The Solution: when logged in verify login location if not located at ~$ then: cd ~  cat readme *remember TAB auto completes Password: boJ9jbbUNNfktd78OOpsqOltutMc3MY1
Post a Comment
Read more