Bandit 21 Over The Wire

Lessons Learned

reading other peoples bash scripts

Logging in

On a kali vm/ linux machine

Type:

ssh bandit21@bandit.labs.overthewire.org -p 2220

gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr

Completing The Challenge

The Goal:

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

The Solution:

bandit21@bandit:~$ ls /etc/cron.d/

cronjob_bandit15_root  cronjob_bandit17_root  cronjob_bandit22  cronjob_bandit23  cronjob_bandit24  cronjob_bandit25_root

bandit21@bandit:~$ cat /etc/cron.d/cronjob_bandit22

@reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null

* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null

bandit21@bandit:~$ cat /usr/bin/cronjob_bandit22.sh

#!/bin/bash

chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

bandit21@bandit:~$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI

I am very happy to say this was all done on a phone. Using juicessh and the blogger app.

So, I really wanted to see a method for crontab to just tell me what was running, but i couldn't find that. I then decided to go with next best thing, which was:

We're trying to get access to bandit22 

There is a bandit22 file in cron.d 

I should follow that and see what I find.

If you cat the file that outputs to null you'll see it creates a file that everyone can read, and copies the bandit22 password to it. All that's left is to read that file.