bandit4@bandit:~/inhere$ file ./-file* ./-file00: data ./-file01: data ./-file02: data ./-file03: data ./-file04: data ./-file05: data ./-file06: data ./-file07: ASCII text ./-file08: data ./-file09: data bandit4@bandit:~/inhere$ cat ./-file07 lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR
bandit10@bandit:~$ ls -alih total 24K 517540 drwxr-xr-x 2 root root 4.0K Oct 5 06:19 . 1514 drwxr-xr-x 70 root root 4.0K Oct 5 06:20 .. 517543 -rw-r--r-- 1 root root 220 Jan 6 2022 .bash_logout 517542 -rw-r--r-- 1 root root 3.7K Jan 6 2022 .bashrc 517703 -rw-r----- 1 bandit11 bandit10 69 Oct 5 06:19 data.txt 517541 -rw-r--r-- 1 root root 807 Jan 6 2022 .profile bandit10@bandit:~$ base64 -d data.txt The password is 6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM
Level 11 → Level 12
bandit11@bandit:~$ ls -alih total 24K 517545 drwxr-xr-x 2 root root 4.0K Oct 5 06:19 . 1514 drwxr-xr-x 70 root root 4.0K Oct 5 06:20 .. 517548 -rw-r--r-- 1 root root 220 Jan 6 2022 .bash_logout 517547 -rw-r--r-- 1 root root 3.7K Jan 6 2022 .bashrc 517704 -rw-r----- 1 bandit12 bandit11 49 Oct 5 06:19 data.txt 517546 -rw-r--r-- 1 root root 807 Jan 6 2022 .profile bandit11@bandit:~$ cat data.txt Gur cnffjbeq vf WIAOOSFzMjXXBC0KoSKBbJ8puQm5lIEi bandit11@bandit:~$ cat data.txt | tr'a-zA-Z''n-za-mN-ZA-M' The password is JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv bandit11@bandit:~$ cat data.txt | tr [a-zA-Z] [n-za-mN-ZA-M] The password is JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv bandit11@bandit:~$ cat data.txt | tr a-zA-Z n-za-mN-ZA-M The password is JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv
Level 12 → Level 13
bandit12@bandit:~$ mkdir /tmp/evo1 bandit12@bandit:~$ cp data.txt /tmp/evo1/ bandit12@bandit:~$ cd /tmp/evo1 bandit12@bandit:/tmp/evo1$ ls -ali total 408 303152 drwxrwxr-x 2 bandit12 bandit12 4096 Mar 22 17:10 . 1554 drwxrwx-wt 248 root root 405504 Mar 22 17:10 .. 303195 -rw-r----- 1 bandit12 bandit12 2582 Mar 22 17:10 data.txt bandit12@bandit:/tmp/evo1$ file data.txt data.txt: ASCII text bandit12@bandit:/tmp/evo1$ xxd -r data.txt data.bin bandit12@bandit:/tmp/evo1$ ls data.bin data.txt bandit12@bandit:/tmp/evo1$ file data.bin data.bin: gzip compressed data, was "data2.bin", last modified: Thu Oct 5 06:19:20 2023, max compression, from Unix, original size modulo 2^32 573 bandit12@bandit:/tmp/evo1$ mv data.bin data.gz bandit12@bandit:/tmp/evo1$ ls data.gz data.txt bandit12@bandit:/tmp/evo1$ gzip -d data.gz bandit12@bandit:/tmp/evo1$ ls data data.txt bandit12@bandit:/tmp/evo1$ file data data: bzip2 compressed data, block size = 900k bandit12@bandit:/tmp/evo1$ mv data data.bz2 bandit12@bandit:/tmp/evo1$ ls data.bz2 data.txt bandit12@bandit:/tmp/evo1$ bzip2 -d data.bz2 bandit12@bandit:/tmp/evo1$ ls data data.txt bandit12@bandit:/tmp/evo1$ file data data: gzip compressed data, was "data4.bin", last modified: Thu Oct 5 06:19:20 2023, max compression, from Unix, original size modulo 2^32 20480 bandit12@bandit:/tmp/evo1$ mv data data.gz bandit12@bandit:/tmp/evo1$ gzip -d data.gz bandit12@bandit:/tmp/evo1$ ls data data.txt bandit12@bandit:/tmp/evo1$ file data data: POSIX tar archive (GNU) bandit12@bandit:/tmp/evo1$ mv data data.tar bandit12@bandit:/tmp/evo1$ tar -xvf data.tar data5.bin bandit12@bandit:/tmp/evo1$ file data5.bin data5.bin: POSIX tar archive (GNU) bandit12@bandit:/tmp/evo1$ mv data5.bin data5.tar bandit12@bandit:/tmp/evo1$ tar -xvf data5.tar data6.bin bandit12@bandit:/tmp/evo1$ file data6.bin data6.bin: bzip2 compressed data, block size = 900k bandit12@bandit:/tmp/evo1$ mv data6.bin data6.bz2 bandit12@bandit:/tmp/evo1$ bzip2 -d data6.bz2 bandit12@bandit:/tmp/evo1$ ls data5.tar data6 data.tar data.txt bandit12@bandit:/tmp/evo1$ file data6 data6: POSIX tar archive (GNU) bandit12@bandit:/tmp/evo1$ mv data6 data6.tar bandit12@bandit:/tmp/evo1$ tar -xvf data6.tar data8.bin bandit12@bandit:/tmp/evo1$ file data8.bin data8.bin: gzip compressed data, was "data9.bin", last modified: Thu Oct 5 06:19:20 2023, max compression, from Unix, original size modulo 2^32 49 bandit12@bandit:/tmp/evo1$ mv data8.bin data8.gz bandit12@bandit:/tmp/evo1$ gzip -d data8.gz bandit12@bandit:/tmp/evo1$ ls data5.tar data6.tar data8 data.tar data.txt bandit12@bandit:/tmp/evo1$ file data8 data8: ASCII text bandit12@bandit:/tmp/evo1$ cat data8 The password is wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw
Level 13 → Level 14
bandit13@bandit:~$ ssh -i sshkey.private bandit14@localhost -p2220 The authenticity of host '[localhost]:2220 ([127.0.0.1]:2220)' can't be established. ED25519 key fingerprint is SHA256:C2ihUBV7ihnV1wUXRb4RrEcLfXC5CXlhmAAM/urerLY. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
bandit22@bandit:~$ cd /etc/cron.d/ bandit22@bandit:/etc/cron.d$ ll total 56 drwxr-xr-x 2 root root 4096 Oct 5 06:20 ./ drwxr-xr-x 106 root root 12288 Oct 5 06:20 ../ -rw-r--r-- 1 root root 62 Oct 5 06:19 cronjob_bandit15_root -rw-r--r-- 1 root root 62 Oct 5 06:19 cronjob_bandit17_root -rw-r--r-- 1 root root 120 Oct 5 06:19 cronjob_bandit22 -rw-r--r-- 1 root root 122 Oct 5 06:19 cronjob_bandit23 -rw-r--r-- 1 root root 120 Oct 5 06:19 cronjob_bandit24 -rw-r--r-- 1 root root 62 Oct 5 06:19 cronjob_bandit25_root -rw-r--r-- 1 root root 201 Jan 8 2022 e2scrub_all -rwx------ 1 root root 52 Oct 5 06:20 otw-tmp-dir* -rw-r--r-- 1 root root 102 Mar 23 2022 .placeholder -rw-r--r-- 1 root root 396 Feb 2 2021 sysstat bandit22@bandit:/etc/cron.d$ cat cronjob_bandit23 @reboot bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null * * * * * bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null bandit22@bandit:/etc/cron.d$ cat /usr/bin/cronjob_bandit23.sh #!/bin/bash
myname=$(whoami) mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo"Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget bandit22@bandit:/etc/cron.d$ whoami bandit22 bandit22@bandit:/etc/cron.d$ cat /tmp/$(echo I am user bandit23 | md5sum | cut -d ' ' -f 1) QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G
Level 23 → Level 24
在执行脚本的目录下写个脚本把密码读出来，记得赋予可执行权限
bandit23@bandit:~$ cd /var/spool/bandit24/foo bandit23@bandit:/var/spool/bandit24/foo$ vim getpass.sh bandit23@bandit:/var/spool/bandit24/foo$ cat getpass.sh #!/bin/bash
[+]Try PinCode: 9014 b'Wrong! Please enter the correct pincode. Try again.\n' [+]Try PinCode: 9015 b'Correct!\n' [*]Pincode: 9015 [+] Receiving all data: Done (76B) [*] Closed connection to localhost port 30002 b'The password of user bandit25 is p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d\n\nExiting.\n'
Level 25 → Level 26
bandit25@bandit:~$ ls bandit26.sshkey bandit25@bandit:~$ ssh -i bandit26.sshkey bandit26@localhost kex_exchange_identification: Connection closed by remote host Connection closed by 127.0.0.1 port 22 bandit25@bandit:~$ cat /etc/passwd | grep bandit26 bandit26:x:11026:11026:bandit level 26:/home/bandit26:/usr/bin/showtext bandit25@bandit:~$ cat /usr/bin/showtext #!/bin/sh
:set shell sh=/bin/sh :sh $ ls -al total 44 drwxr-xr-x 3 root root 4096 Oct 5 06:19 . drwxr-xr-x 70 root root 4096 Oct 5 06:20 .. -rw-r--r-- 1 root root 220 Jan 6 2022 .bash_logout -rw-r--r-- 1 root root 3771 Jan 6 2022 .bashrc -rw-r--r-- 1 root root 807 Jan 6 2022 .profile drwxr-xr-x 2 root root 4096 Oct 5 06:19 .ssh -rwsr-x--- 1 bandit27 bandit26 14876 Oct 5 06:19 bandit27-do -rw-r----- 1 bandit26 bandit26 258 Oct 5 06:19 text.txt $ ./bandit27-docat /etc/bandit_pass/bandit27 YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS
Level 27 → Level 28
bandit27@bandit:~$ cd /tmp bandit27@bandit:/tmp$ mkdir evo2 bandit27@bandit:/tmp$ cd evo2 bandit27@bandit:/tmp/evo2$ git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo Cloning into 'repo'... The authenticity of host '[localhost]:2220 ([127.0.0.1]:2220)' can't be established. ED25519 key fingerprint is SHA256:C2ihUBV7ihnV1wUXRb4RrEcLfXC5CXlhmAAM/urerLY. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Could not create directory '/home/bandit27/.ssh' (Permission denied). Failed to add the host to the list of known hosts (/home/bandit27/.ssh/known_hosts). _ _ _ _ | |__ __ _ _ __ __| (_) |_ | '_ \ / _` | '_ \ / _` | | __| | |_) | (_| | | | | (_| | | |_ |_.__/ \__,_|_| |_|\__,_|_|\__| This is an OverTheWire game server. More information on http://www.overthewire.org/wargames bandit27-git@localhost's password: remote: Enumerating objects: 3, done. remote: Counting objects: 100% (3/3), done. remote: Compressing objects: 100% (2/2), done. remote: Total 3 (delta 0), reused 0 (delta 0), pack-reused 0 Receiving objects: 100% (3/3), done. bandit27@bandit:/tmp/evo2$ ls repo bandit27@bandit:/tmp/evo2$ cd repo bandit27@bandit:/tmp/evo2/repo$ ll total 16 drwxrwxr-x 3 bandit27 bandit27 4096 Mar 25 09:08 ./ drwxrwxr-x 3 bandit27 bandit27 4096 Mar 25 09:07 ../ drwxrwxr-x 8 bandit27 bandit27 4096 Mar 25 09:08 .git/ -rw-rw-r-- 1 bandit27 bandit27 68 Mar 25 09:08 README bandit27@bandit:/tmp/evo2/repo$ cat README The password to the next level is: AVanL161y9rsbcJIsFHuw35rjaOM19nR
Level 28 → Level 29
bandit28@bandit:~$ cd /tmp bandit28@bandit:/tmp$ mkdir evo128 bandit28@bandit:/tmp$ cd evo128 bandit28@bandit:/tmp/evo128$ git clone ssh://bandit28-git@localhost:2220/home/bandit28-git/repo Cloning into 'repo'... The authenticity of host '[localhost]:2220 ([127.0.0.1]:2220)' can't be established. ED25519 key fingerprint is SHA256:C2ihUBV7ihnV1wUXRb4RrEcLfXC5CXlhmAAM/urerLY. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Could not create directory '/home/bandit28/.ssh' (Permission denied). Failed to add the host to the list of known hosts (/home/bandit28/.ssh/known_hosts). _ _ _ _ | |__ __ _ _ __ __| (_) |_ | '_ \ / _` | '_ \ / _` | | __| | |_) | (_| | | | | (_| | | |_ |_.__/ \__,_|_| |_|\__,_|_|\__| This is an OverTheWire game server. More information on http://www.overthewire.org/wargames bandit28-git@localhost's password: remote: Enumerating objects: 9, done. remote: Counting objects: 100% (9/9), done. remote: Compressing objects: 100% (6/6), done. remote: Total 9 (delta 2), reused 0 (delta 0), pack-reused 0 Receiving objects: 100% (9/9), done. Resolving deltas: 100% (2/2), done. bandit28@bandit:/tmp/evo128$ ls repo bandit28@bandit:/tmp/evo128$ cd repo bandit28@bandit:/tmp/evo128/repo$ ll total 16 drwxrwxr-x 3 bandit28 bandit28 4096 Mar 25 09:13 ./ drwxrwxr-x 3 bandit28 bandit28 4096 Mar 25 09:13 ../ drwxrwxr-x 8 bandit28 bandit28 4096 Mar 25 09:13 .git/ -rw-rw-r-- 1 bandit28 bandit28 111 Mar 25 09:13 README.md bandit28@bandit:/tmp/evo128/repo$ cat README.md # Bandit Notes Some notes for level29 of bandit.
diff --git a/README.md b/README.md index b302105..5c6457b 100644 --- a/README.md +++ b/README.md @@ -4,5 +4,5 @@ Some notes for level29 of bandit. ## credentials - username: bandit29 -- password: tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S +- password: xxxxxxxxxx
Level 29 → Level 30
bandit29@bandit:~$ cd /tmp bandit29@bandit:/tmp$ mkdir evo129 bandit29@bandit:/tmp$ cd evo129 bandit29@bandit:/tmp/evo129$ git clone ssh://bandit29-git@localhost:2220/home/bandit29-git/repo bandit29@bandit:/tmp/evo129$ cd repo bandit29@bandit:/tmp/evo129/repo$ ls README.md bandit29@bandit:/tmp/evo129/repo$ cat README.md # Bandit Notes Some notes for bandit30 of bandit.
## credentials
- username: bandit30 - password: <no passwords in production!>
bandit29@bandit:/tmp/evo129/repo$ git branch -a * master remotes/origin/HEAD -> origin/master remotes/origin/dev remotes/origin/master remotes/origin/sploits-dev bandit29@bandit:/tmp/evo129/repo$ git checkout dev Branch 'dev'set up to track remote branch 'dev' from 'origin'. Switched to a new branch 'dev' bandit29@bandit:/tmp/evo129/repo$ ls code README.md bandit29@bandit:/tmp/evo129/repo$ cat README.md # Bandit Notes Some notes for bandit30 of bandit.
bandit30@bandit:~$ cd /tmp bandit30@bandit:/tmp$ mkdir evo130 bandit30@bandit:/tmp$ cd evo130 bandit30@bandit:/tmp/evo130$ git clone ssh://bandit30-git@localhost:2220/home/bandit30-git/repo bandit30@bandit:/tmp/evo130$ ls repo bandit30@bandit:/tmp/evo130$ cd repo bandit30@bandit:/tmp/evo130/repo$ ls README.md bandit30@bandit:/tmp/evo130/repo$ cat README.md just an epmty file... muahaha bandit30@bandit:/tmp/evo130/repo$ git show-ref d39631d73f786269b895ae9a7b14760cbf40a99f refs/heads/master d39631d73f786269b895ae9a7b14760cbf40a99f refs/remotes/origin/HEAD d39631d73f786269b895ae9a7b14760cbf40a99f refs/remotes/origin/master 831aac2e2341f009e40e46392a4f5dd318483019 refs/tags/secret bandit30@bandit:/tmp/evo130/repo$ git show 831a OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt
Level 31 → Level 32
bandit31@bandit:~$ cd /tmp bandit31@bandit:/tmp$ mkdir evo131 bandit31@bandit:/tmp$ cd evo131 bandit31@bandit:/tmp/evo131$ git clone ssh://bandit31-git@localhost:2220/home/bandit31-git/repo bandit31@bandit:/tmp/evo131$ cd repo bandit31@bandit:/tmp/evo131/repo$ ls README.md bandit31@bandit:/tmp/evo131/repo$ cat README.md This time your task is to push a file to the remote repository.
Details: File name: key.txt Content: 'May I come in?' Branch: master
bandit31@bandit:/tmp/evo131/repo$ echo"May I come in?" > key.txt bandit31@bandit:/tmp/evo131/repo$ git add -f key.txt bandit31@bandit:/tmp/evo131/repo$ git status On branch master Your branch is up to date with 'origin/master'.
Changes to be committed: (use "git restore --staged <file>..." to unstage) new file: key.txt
bandit31@bandit:/tmp/evo131/repo$ git commit -m "key.txt" [master 5d3806a] key.txt 1 file changed, 1 insertion(+) create mode 100644 key.txt bandit31@bandit:/tmp/evo131/repo$ git push origin master kex_exchange_identification: Connection closed by remote host Connection closed by 127.0.0.1 port 2220 fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists. bandit31@bandit:/tmp/evo131/repo$ git push origin master ...... remote: Well done! Here is the password for the next level: remote: rmCBvG56y58BXzv98yZGdO7ATVL5dW8y ......
Level 32 → Level 33
WELCOME TO THE UPPERCASE SHELL >> $0 $ cat /etc/bandit_pass/bandit33 odHo63fHiFqcWWJG9rLiLDtPm45KzUKy
