Bandit 22 Over the Wire

Lessons Learned

understanding more complicated bash scripts

Logging in

On a kali vm/ linux machine

Type:

ssh bandit22@bandit.labs.overthewire.org -p 2220

Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI

Completing The Challenge

The Goal:

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

The Solution:

bandit22@bandit:~$ ls /etc/cron
cron.d/       cron.hourly/  crontab       
cron.daily/   cron.monthly/ cron.weekly/  
bandit22@bandit:~$ ls /etc/cron
cron.d/       cron.hourly/  crontab       
cron.daily/   cron.monthly/ cron.weekly/  
bandit22@bandit:~$ ls /etc/cron.d/
cronjob_bandit15_root  cronjob_bandit22  cronjob_bandit24
cronjob_bandit17_root  cronjob_bandit23  cronjob_bandit25_root
bandit22@bandit:~$ cat /etc/cron.d/cronjob_bandit23
@reboot bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
bandit22@bandit:~$ cat /usr/bin/cronjob_bandit23.sh
#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget

Here I will try to interpret the shell script

myname is a call of whoami, this should be bandit23 since its a job set up by them

mytarget is an echo that says "I am user bandit23" which is piped to md5sum, the resulting hash is piped to cut which im not entirely sure how it works. so i will write what I do to understand below.

man cut

-d, --delimiter=DELIM
              use DELIM instead of TAB for field delimiter

 -f, --fields=LIST
              select only these fields;  also print any  line  that  contains no delimiter character, unless the -s option is specified

bandit22@bandit:~$ echo I am user bandit23 | md5sum
8ca319486bfbbc3663ea0fbe81326349  -
bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' '
cut: you must specify a list of bytes, characters, or fields
Try 'cut --help' for more information.

This shows that the md5sum results in a string with spaces, using the ' ' as a delimiter results in 2 fields, the first containing the md5sum of "I am user bandit23", the other containing a -. I will now verify this:

 bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1
8ca319486bfbbc3663ea0fbe81326349
bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 2

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 3
-
bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 4

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 5

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 6

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 10

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 100

bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1000

as shown above, i was wrong.

there were 2 spaces so the cut did finish with those two variables as separate fields, but it wasn't just 2 fields, i also am not sure why i can keep calling up to field 1000 without issue, but ill leave that for later, if i feel like it.

anyway, final command in the file shows that the password of bandit23 was copied to a tmp file by the name of
8ca319486bfbbc3663ea0fbe81326349

now there are 2 ways this cat can be done:

 bandit22@bandit:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349
jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n
bandit22@bandit:~$ cat /tmp/$(echo I am user bandit23 | md5sum | cut -d ' ' -f 1)
jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n