From e43091d6aea2d484e070e34d7811c8a4bed00e12 Mon Sep 17 00:00:00 2001 From: Sh0g0-1758 Date: Tue, 18 Apr 2023 16:02:48 +0530 Subject: [PATCH 1/3] final_submission --- README.md | 451 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 451 insertions(+) diff --git a/README.md b/README.md index efade42..216d4cc 100644 --- a/README.md +++ b/README.md @@ -1 +1,452 @@ Assignment submissions here + +### SUBMISSION BY SHOGO ### +# P.S. sorry for the delay :( + +the password for the first level is NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL +the password for the second level is rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi +the password for the third level is aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG +the password for the fourth level is 2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe +the password for the fifth level is lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR +the password for the sixth level is P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU +the password for the seventh level is z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S +the password for the eigth level is TESKZC0XvTetK0S9xNwm25STk5iWrBvP +the password for the ninth level is EN632PlfYiZbn3PhVK3XOGSlNInNE00t and command is sort data.txt | uniq -u +the password for the tenth level is G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s and command is strings data.txt | grep -i "=======" +the password for the eleventh level is 6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM and command is base64 -d data.txt +the password for the twelveth level is JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv and command is cat data.txt and then ROT13 decoding it +the password for the thirteenth level is wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw and the command used is :-> + + 1 clear + 2 ls + 3 cd /tmp + 4 ls + 5 mkdir store + 6 cd store + 7 cd ~ + 8 cp data.txt /tmp/store + 9 cd /tmp/store + 10 ls + 11 mv data.txt hexdump + 12 ls + 13 cat hexdump + 14 xxd -r hexdump compressed + 15 ls + 16 cat compressed + 17 clear + 18 ls + 19 cat compressed + 20 mv compressed compress.gz + 21 ls + 22 cat compress.gz + 23 gzip -d compress.gz + 24 ls + 25 cat compress + 26 xxd compress + 27 cat hexdump + 28 cd ~ + 29 cat data.txt + 30 clear + 31 ls + 32 cd /tmp/help + 33 ls + 34 cd // + 35 cd /tmp/final + 36 ls + 37 cd repo + 38 ls + 39 cat README + 40 cd .. + 41 cd ~ + 42 ls + 43 cd /tmp + 44 mkdir armin + 45 cd armin + 46 ls + 47 cd ~ + 48 cp data.txt /tmp/armin + 49 cd /tmp/armin + 50 ls + 51 xxd -r data.txt data + 52 ls + 53 file data + 54 mv data data.gz + 55 gzip -d data + 56 file data + 57 ls + 58 mv data data.bz2 + 59 bzip2 -d data.bz2 + 60 file data + 61 mv data data.gz + 62 gzip -d data.gz + 63 file data + 64 mv data data.tar + 65 tar xvf data.tar + 66 ls + 67 file data5.bin + 68 mv data5.bin data6.tar + 69 tar xvf data6.tar + 70 file data6.bin + 71 mv data6.bin data7.bz + 72 bzip -d data7.bz + 73 bzip2 -d data7.bz + 74 ls + 75 file data7 + 76 mv data7 data7.tar + 77 tar xvf data7.tar + 78 file data8.bin + 79 mv data8.bin data9.gz + 80 gzip -d data9.gz + 81 ls + 82 fiel data9 + 83 file data9 + 84 cat data9 + 85 history +the password for the fourteenth level is fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq and the commmand used is ssh bandit14@localhost -i sshkey.private and then cat /etc/bandit_pass/bandit14 +the password for the fifteenth level is jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt and the command used is nc localhost 30000 and then fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq +the password for the sixteenth level is JQttfApK4SeyHwDlI9SXGR50qclOAil1 and the command used is echo jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt | openssl s_client -connect localhost:30001 -ign_eof +the password for the seventeenth level is not given. it's credentials are given to us. +these are +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ +imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ +Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu +DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW +JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX +x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD +KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl +J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd +d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC +YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A +vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama ++TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT +8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx +SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd +HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt +SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A +R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi +Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg +R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu +L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni +blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU +YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM +77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b +dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3 +vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY= +-----END RSA PRIVATE KEY----- + +the commands used are + 1 clear + 2 ls + 3 clar + 4 clear + 5 nmap -p 31000-32000 localhost + 6 nmap -p 31000-32000 localhost --version-intensity 1 + 7 nc localhost:31046 + 8 nc localhost 31046 + 9 nc lcoalhost 31518 + 10 JQttfApK4SeyHwDlI9SXGR50qclOAil1 + 11 nc localhost 31518 + 12 nc localhost 31691 + 13 nc localhost 31790 + 14 nc localhost 31960 + 15 echo JQttfApK4SeyHwDlI9SXGR50qclOAil1 | openssl s_client -connect localhost:31518 -ign_eof + 16 echo JQttfApK4SeyHwDlI9SXGR50qclOAil1 | openssl s_client -connect localhost:31790 -ign_eof + 17 mkdir temp + 18 cd /tmp/shogo + 19 ls + 20 nano take + 21 ls + 22 nano eren + 23 nano meko + 24 cd .. + 25 ls + 26 cd /tmp + 27 ls + 28 mkdir someone + 29 cd someone + 30 ls + 31 clear + 32 nano take + 33 cat take + 34 ssh bandit17@localhost -i take + 35 ssh bandit17@localhost -i take -p 2220 + 36 mv take take.private + 37 ls + 38 cat take.private + 39 clear + 40 ssh bandit17@localhost -i take.private -p 2220 + 41 ls + 42 cat take.private + 43 ssh bandit17@localhost -i take.private -p 2220 + 44 history +the password for the 18 level is hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg and the command is diff . +the password for the 19 level is awhqfNnAbc1naukrpqDYcF95h7HoMTrC and the command is ssh -t bandit18@bandit.labs.overthewire.org -p 2220 "bash --noprofile --norc" +the password for the 20 level is VxCazJaVykI6W36BkBU0mJTCM8rR95XT and the command is ./bandit20-do cat /etc/bandit_pass/bandit20 +the password for the 21 level is NvEJF7oVjkddltPSrdKEFOllh9V1IBcq and the command is echo "VxCazJaVykI6W36BkBU0mJTCM8rR95XT" | nc -l localhost 1234 and then ./suconnect 1234 +the password for the 22 level is WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff and the command is crontab -l and then going where the data specifies. +the password for the 23 level is QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G and the command is first check the shell script that is running at regular interval by going at /etc/cron.d and then modifying the shell script to accomadate it according to our needs, basically changing the user to bandit23 instead of whoami. +the password for the 24 level is VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar and the command is :-> + + 1 clear + 2 ls + 3 clear + 4 cd /etc/cron.d + 5 ls + 6 cat cronjob_bandit24 + 7 cd /usr/bin + 8 cat cronjob_bandit24.sh + 9 cd var/spool/bandit24/foo + 10 cd var/spool + 11 cd /var/spool/bandit24/foo + 12 ls + 13 ls -la + 14 cd /tmp + 15 mkdir eren + 16 mkdir shell_script + 17 cd shell_script + 18 cd /var/spool/bandit24/foo + 19 touch moi + 20 nano moi + 21 date + 22 cd /tmp/shell_script + 23 ls + 24 date + 25 ls + 26 date + 27 cd /var/spool/bandit24/foo + 28 nano moi + 29 cd /tmp/shell_script + 30 ls + 31 touch password + 32 chmod 777 password + 33 ls -al password + 34 ls + 35 cd /var/spool/bandit24/foo + 36 touch moi + 37 nano moi + 38 cd /tmp/shell_script + 39 ls + 40 date + 41 cat password + 42 ls -la password + 43 cat password + 44 date + 45 cd /var/spool/bandit24/foo + 46 cat moi + 47 date + 48 nano moi + 49 cat moi + 50 date + 51 cd /tmp/shell_script + 52 ls + 53 date + 54 cat password + 55 chmod 666 password + 56 ls -la password + 57 touch scrit + 58 mv scrit script + 59 ls + 60 mv script script.sh + 61 chmod 777 script.sh + 62 ls -la script.sh + 63 nano script.sh + 64 ls + 65 cat script.sh + 66 cp script.sh /var/spool/bandit24/foo + 67 date + 68 ls + 69 cat password + 70 history +the password for the 25 level is p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d and the command used is :-> + + 1 clear + 2 ls + 3 clear + 4 nc localhost 30002 + 5 cd /tmp + 6 mkdir band24 + 7 mkdir hope + 8 mkdir exist + 9 cd exist + 10 touch meh + 11 nano meh + 12 mv meh meh.sh + 13 chmod 777 meh.sh + 14 nano meh.sh + 15 cat meh.sh + 16 cat meh.sh | nc localhost 30002 + 17 nano meh.sh + 18 cat meh.sh | nc localhost 30002 + 19 ./meh.sh + 20 nano meh.sh + 21 ./meh.sh + 22 cat meh.sh | nc localhost 30002 + 23 nano meh.sh + 24 ./meh.sh + 25 nano meh.sh + 26 ./meh.sh + 27 nano meh.sh + 28 ./meh.sh + 29 nano meh.sh + 30 ls + 31 nano meh.sh + 32 touch hope + 33 chmod 777 hope + 34 ls -la hope + 35 ./meh.sh + 36 nano meh.sh + 37 ./meh.sh + 38 nano meh.sh + 39 ./meh.sh + 40 ls + 41 cat hope + 42 nano meh.sh + 43 cat hope + 44 nano hope + 45 cat hope + 46 nano hope + 47 cat hope + 48 ./meh.sh + 49 nano hope + 50 cat hope + 51 clear + 52 ls + 53 nc localhost 30002 < hope + 54 history +and the script used is + +#!/bin/bash + +for i in {0..9}; +do + echo VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar 000$i >> /tmp/exist/hope + +done + +for i in {10..99}; +do + echo VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar 00$i >> /tmp/exist/hope +done + +for i in {100..999}; +do + echo VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar 0$i >> /tmp/exist/hope +done + +for i in {1000..9999}; + +do + echo VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar $i >> /tmp/exist/hope +done + +the password for the 26 level is c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1 and the command used is well first check which shell is being used by the user by cat /etc/passwd . then we see that user bandit26 uses a very different shell. We then go to /usr/bin/nameofshell to get info about that. there we see that the shell is very limited and uses only the more command. hence we resize our terminal when we log into bandit26. hence we are now in more. We can open vim using the v command and further in vim we can simply use the :e command to get access to the file where the passwords are stored. +the password for the 27 level is YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS and the command used is first get the shell as described above and then run the binary with cat /etc/bandit_pass/bandit27. +the password for the 28 level is AVanL161y9rsbcJIsFHuw35rjaOM19nR and the command used is git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo +the password for the 29 level is tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S and the command used is git revert +the password for the 30 level is xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS and the command used is git branch -a to get hold of the remote branches as well. +the password for the 31 level is OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt and the command used is :=> + + 1 cd tmp + 2 cd /tmp + 3 mkdir nezu + 4 cd nezu + 5 clear + 6 ls + 7 clear + 8 git clone ssh://bandit30-git@localhost:2220/home/bandit30-git/repo + 9 clear + 10 ls + 11 cd repo + 12 ls + 13 cat README.md + 14 git branch + 15 git branch -a + 16 git checkout remotes/origin/master + 17 ls + 18 cat README.md + 19 git branch + 20 git log + 21 find password + 22 grep password + 23 man grep + 24 git --help + 25 git diff + 26 git log -a + 27 git status + 28 git checkout master + 29 git branch + 30 git switch master + 31 git switch /origin/master + 32 clear + 33 git --help + 34 grep password + 35 ls + 36 cat README.md + 37 grep "just" + 38 grep just + 39 grep just README.md + 40 grep "just" README.md + 41 grep password README.md + 42 grep an README.md + 43 grep an empty README.md + 44 grep "an empty" README.md + 45 grep "an epmty" README.md + 46 file README.md + 47 du README.md + 48 git branch + 49 git tag + 50 cat secret + 51 git tag + 52 git fetch -tags + 53 git fetch -all -tags + 54 git fetch --tags + 55 git tag + 56 git show secret + 57 history + +the password for the 32 level is rmCBvG56y58BXzv98yZGdO7ATVL5dW8y and the command used is :-> + + 1 clear + 2 cd /tmp + 3 mkdir lonely + 4 cd lonely + 5 clear + 6 git clone ssh://bandit31-git@localhost/home/bandit31-git/repo + 7 git clone ssh://bandit31-git@localhost:2220/home/bandit31-git/repo + 8 cd repo + 9 cat README.md + 10 nano key.txt + 11 ls + 12 git push -u origin master + 13 ls + 14 cat key.txt + 15 cat README.md + 16 git status + 17 git branch + 18 git branch - + 19 git branch -a + 20 cd .. + 21 mv repo ok + 22 git clone ssh://bandit31-git@localhost:2220/home/bandit31-git/repo + 23 ls + 24 cd repo + 25 ls + 26 cat README.md + 27 cd .. + 28 cd repo + 29 ls + 30 touch key.txt + 31 echo "May I come in?" > key.txt + 32 cat key.txt + 33 git add . + 34 git add key.txt + 35 rm .gitignore + 36 git add key.txt + 37 git commit -m "added some key!" + 38 git status + 39 git push origin master + 40 history +the password for the level 33 is odHo63fHiFqcWWJG9rLiLDtPm45KzUKy and the command used is $0. then checking that we are user bandit 33 and hence can access the bandit_pass file. +this is a very useful command https://askubuntu.com/questions/350208/what-does-2-dev-null-mean for question 6 +The uniq command accepts input from a text-based file and removes any repeated lines, only if they are adjacent to each other. That’s why it’s used in conjunction with sort to remove non-adjacent lines. From b655c5e55e6ffae75747b1f0943f79bd024a4c4a Mon Sep 17 00:00:00 2001 From: Sh0g0-1758 Date: Tue, 18 Apr 2023 16:05:56 +0530 Subject: [PATCH 2/3] final --- README.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 216d4cc..ae30134 100644 --- a/README.md +++ b/README.md @@ -107,6 +107,7 @@ the password for the fifteenth level is jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt and the the password for the sixteenth level is JQttfApK4SeyHwDlI9SXGR50qclOAil1 and the command used is echo jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt | openssl s_client -connect localhost:30001 -ign_eof the password for the seventeenth level is not given. it's credentials are given to us. these are + -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ @@ -135,6 +136,7 @@ dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3 vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY= -----END RSA PRIVATE KEY----- + the commands used are 1 clear 2 ls @@ -180,8 +182,13 @@ the commands used are 42 cat take.private 43 ssh bandit17@localhost -i take.private -p 2220 44 history + + the password for the 18 level is hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg and the command is diff . -the password for the 19 level is awhqfNnAbc1naukrpqDYcF95h7HoMTrC and the command is ssh -t bandit18@bandit.labs.overthewire.org -p 2220 "bash --noprofile --norc" + +the password for the 19 level is awhqfNnAbc1naukrpqDYcF95h7HoMTrC and the command is ssh -t bandit18@bandit.labs. +overthewire.org -p 2220 "bash --noprofile --norc" + the password for the 20 level is VxCazJaVykI6W36BkBU0mJTCM8rR95XT and the command is ./bandit20-do cat /etc/bandit_pass/bandit20 the password for the 21 level is NvEJF7oVjkddltPSrdKEFOllh9V1IBcq and the command is echo "VxCazJaVykI6W36BkBU0mJTCM8rR95XT" | nc -l localhost 1234 and then ./suconnect 1234 the password for the 22 level is WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff and the command is crontab -l and then going where the data specifies. From 3d53e4c694a87f69684282c2507562695902b8ef Mon Sep 17 00:00:00 2001 From: Sh0g0-1758 Date: Tue, 18 Apr 2023 16:06:44 +0530 Subject: [PATCH 3/3] last commit --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ae30134..36aad2e 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ Assignment submissions here -### SUBMISSION BY SHOGO ### -# P.S. sorry for the delay :( +# SUBMISSION BY shogo +

P.S. sorry for the delay :(

the password for the first level is NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL the password for the second level is rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi