Skip to main content

Bandit 20 Over The Wire

Lessons Learned

using nc to create a steady connection, also on background and foreground processes

Logging in


On a kali vm/ linux machine
Type:

ssh bandit20@bandit.labs.overthewire.org -p 2220
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

Completing The Challenge

The Goal:

There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21).

The Solution:

bandit20@bandit:~$ nc -l -p 2000
^Z
[1]+  Stopped                 nc -l -p 2000
bandit20@bandit:~$ ./suconnect 2000
^Z
[2]+  Stopped                 ./suconnect 2000
bandit20@bandit:~$ fg 1
nc -l -p 2000
GbKksEFF4yrVs6il55v6gwY5aVje5f0j
^Z
[1]+  Stopped                 nc -l -p 2000
bandit20@bandit:~$ fg 2
./suconnect 2000
Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Password matches, sending next password
bandit20@bandit:~$ fg1
-bash: fg1: command not found
bandit20@bandit:~$ fg 1
nc -l -p 2000
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr


this took me some time since i kept wanting to use the -c but that sends one message and closes, it wasn't till i read https://www.computerhope.com/unix/nc.htm that i understood that "nc -l -p port" creates an active connection that wont actively close after the first message and can be used to keep sending and receiving messages.

Labels:

Comments

Post a Comment

Popular posts from this blog

Bandit 12 Over The Wire

Lessons Learned extracting and decompressing files using the following tools: file, xxd -r, gunzip, bunsip2, and tar -xf Logging in On a kali vm/ linux machine Type: ssh bandit12@bandit.labs.overthewire.org -p 2220  5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu Completing The Challenge The Goal: The password for the next level is stored in the file data.txt , which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!) The Solution:      Revamped:         I decided to write a bash file that solves the problem.                    mkdir /tmp/a_name/                    mv data.txt /tmp/a_name      ...
Post a Comment
Read more

Bandit 23 Over The Wire

Lessons Learned understanding more complicated bash scripts and writing bash scripts to take advantage of automated processes Logging in On a kali vm/ linux machine Type: ssh bandit23@bandit.labs.overthewire.org -p 2220 jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n  Completing The Challenge The Goal: A program is running automatically at regular intervals from cron , the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed. The Solution: bandit23@bandit:~$ cat /etc/cron.d/cronjob_bandit24 @reboot bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null * * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null bandit23@bandit:~$ cat /usr/bin/cronjob_bandit24.sh #!/bin/bash myname=$(whoami) cd /var/spool/$myname echo "Executing and deleting all scripts in /var/spool/$myname:" for i in * .*; do     if [ "$i" != "." -a "$i" != ".." ];     then         echo "Handling $i...
Post a Comment
Read more

Bandit 22 Over the Wire

Lessons Learned understanding more complicated bash scripts Logging in On a kali vm/ linux machine Type: ssh bandit22@bandit.labs.overthewire.org -p 2220 Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI Completing The Challenge The Goal: A program is running automatically at regular intervals from cron , the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed. The Solution: bandit22@bandit:~$ ls /etc/cron cron.d/       cron.hourly/  crontab        cron.daily/   cron.monthly/ cron.weekly/   bandit22@bandit:~$ ls /etc/cron cron.d/       cron.hourly/  crontab        cron.daily/   cron.monthly/ cron.weekly/   bandit22@bandit:~$ ls /etc/cron.d/ cronjob_bandit15_root  cronjob_bandit22  cronjob_bandit24 cronjob_bandit17_root  cronjob_bandit23  cronjob_bandit25_root bandit22@ba...
Post a Comment
Read more