Week 04: Something Awesome Bandit Game LevelsĀ 12 - 17
data.txt is a hexdump of a file that has been repeatedly compressed??
It said to do mkdir /tmp/myname123 but the folder already exists
Iām curious, does everybody that plays this level make their own directory, so I canāt make one that already exists?
Aha yes thatās it, I made a new folder
mkdir /tmp/nowayyouhavethesamefolder/Ā
I copied over the file, itās telling me to rename the file? But to whatĀ
Aha, xxd can reverse a hexdump file into regular binary
I thought that I had to do xxd -r data.txt |Ā xxd -r data.txt | xxd -r data.txt a bunch of times, but that didnāt work
Stopped at 8:55pm, started again at 10:30pmĀ
I tried decompressing the file with bzip2, butĀ āitās not a bzip typeā
I tried xxd -rp data.txt test and then mv test test.gz, followed by gzip -d test.gz, and I got a couple of letters/numbers, maybe Iām getting somewhere?
10:58pm - I found out a linux command called file [filename] which tells you the file type
After I ran xxd -r data.txt test, I ran file test, and it told me it was a gzip file, okay okay
So I renamed test to test.gz, and unzipped it with gzip -d test.gz
I kept on running file test, to find out what kind of compressed file it was, t hen I would rename it with the right extension and uncompress it
I did this a bunch of times and ended up with the passwordĀ
I wonder if I should delete the folder or just leave it thereĀ
The helpful reading link sent me to a page about ssh and public/private keys :DĀ
I think I understand - I need to pretend to be bandit14 and get the ssh key? And then do ssh [LONGKEY] [email protected] -p 2220?
Nevermind, I lsād and found a file called sshkey.privateĀ
I made a file called key.txt with the RSA key in itĀ
Does that mean I donāt need the key from /etc/bandit_pass/bandit14??
Oh nevermind, I can just cat /etc/bandit_pass/bandit14Ā
I guess I can login with both the password and the RSA key
I watched the 5minute internet TLDR video
Read up on ip addresses and ports
I tried echoĀ āpasswordā > localhost/30000 but it said no such file existsĀ
I googled how to send data to local host port and got an askubuntu answer that said echo hello | nc localhost 2003Ā
Not sure if thatās cheating or not ://Ā
Anyways I tried: echo key | nc localhost 30000 and got the passwordĀ
So I tried echo key | nc localhost 30001 first but nothing happened
I glanced through the two links provided
The second link said to do openssl s_client -connect www.feistyduck.com:443
So I tried openssl s_client -connect localhost:30001Ā
It spat out a lot of text, on the website it said it would give an opportunity for input so I pasted in the password and got the new password!
Not too sure why... Iāll figure it outĀ
Finished 5:36pm - break timeĀ
Okay so I need to send the password to a local host with port number somewhere between 31000 and 32000, should I manually go through 1000 ports? :))Ā
Iām following tecminit.com/nmap-command-examples/
Running nmap localhost gives port 22, 113 and 30000
Aha, nmap -p T:31000-32000 localhost gives me 31518 and 31790
Iām not sure how to check which one speaks SSL, I could just try both?
I tried both, 31790 gave me the RSA keyĀ
Yep Iām into bandit17, I did cat /etc/bandit_pass/bandit17 and got the keyĀ
Phew, weāre past networking at least for nowĀ
I just did diff passwords.old passwords.new and got the new password
Reflection: What did I learn?Ā
file [filename] is a useful command to give some info on what kind of file Iām dealing with
tar -xvf file.tar to uncompress tar files
gzip -d test.gz to uncompress gzipād files
bzip2 -d test.bz2 to uncompress bzip2ā²d filesĀ
mv file1 file2 to rename files from file1 to file2Ā
You can ssh in using an RSA key -> ssh -i key.txt [address]
To input data into local host, echo key | nc localhost 30000
nmap -p T:[number]-[number] to scan ports
diff file1 file2 to see the differencesĀ
I think lecturers use this in their autotesting for labs