bandit 풀이

연습삼아 해보면 재밌다 ㅎㅎ

OverTheWire: Bandit

ssh -p 2220 bandit0@bandit.labs.overthewire.org

구글에 검색하면 풀이해주는 많은 블로그들이 있으니 참고하면 된다!

 

 

0  NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL

1  rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi

2  aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG

3  2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe

4  lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR

5  P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU

du -a -b | grep 1033

 

6  find / -size 33c -user bandit7 -group bandit6 2>/dev/null

z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S

 

7 cat data.txt | grep millionth

TESKZC0XvTetK0S9xNwm25STk5iWrBvP

 

8  sort data.txt |uniq -c|grep "1 "

EN632PlfYiZbn3PhVK3XOGSlNInNE00t

 

9 string data.txt | grep "==="

G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s

 

10  base64 --decode data.txt

6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM

 

11  시저암호 해독기

cat ./data.txt | tr [A-Za-z] [N-ZA-Mn-za-m]

JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv

 

12 xxd -r ./data.txt > aa

mv로 확장자 붙이기

wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw

 

13  ssh -i sshkey.private bandit14@localhost -p 2220

fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq

 

14  telnet localhost 30000 [nc 127.0.0.1 30000 도 가능]

jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt

 

15  openssl s_client -connect localhost:30001

JQttfApK4SeyHwDlI9SXGR50qclOAil1

 

16  nmap -p 31000-32000 localhost

mkdir /tmp/KJG1

cd /tmp/KJG1

cat /etc/bandit_pass/bandit16 | openssl s_client -connect localhost:31790 -quiet > sshkey.private

chmod 400 sshkey.private

ssh -i sshkey.private bandit17@localhost -p2220

cat /etc/bandit_pass/bandit17

VwOSWtCA7lRKkTfbr2IDh6awj9RNZM5e

 

17  diff passwords.old passwords.new

hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg

 

18

방법1

bandit17@bandit:~$ ssh bandit18@localhost -p 2220 "cat readme"

bandit17@bandit:~$ mkdir /tmp/KJG2
bandit17@bandit:~$ cd /tmp/KJG2
bandit17@bandit:/tmp/KJG2$ cp ~/.ssh/id_rsa ./

bandit17@bandit:/tmp/KJG2$ chmod 400 id_rsa 

bandit17@bandit:/tmp/KJG2$ ssh -i id_rsa bandit18@localhost -p 2220 "cat readme"

ssh -p 2220 bandit18@bandit.labs.overthewire.org [cmd 창에서]

hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg [이전 암호 입력]

awhqfNnAbc1naukrpqDYcF95h7HoMTrC

 

방법2

ssh -p 2220 bandit18@bandit.labs.overthewire.org  /bin/sh

cat readme

 

 

19  bandit19@bandit:~$ ./bandit20-do cat /etc/bandit_pass/bandit20

VxCazJaVykI6W36BkBU0mJTCM8rR95XT

 

20  echo -n "VxCazJaVykI6W36BkBU0mJTCM8rR95XT" | nc -l -p 1234 &

./suconnect 1234

NvEJF7oVjkddltPSrdKEFOllh9V1IBcq

 

21  cd /etc/cron.d

cat cronjob_bandit22

cat /usr/bin/cronjob_bandit22.sh

WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff

 

22  cd /etc/cron.d/

cat /usr/bin/cronjob_bandit23.sh

echo I am user bandit23 | md5sum | cut -d ' ' -f 1

cat /tmp/8ca319486bfbbc3663ea0fbe81326349

QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G

 

23  cd /etc/cron.d/

cat cronjob_bandit24

cat /usr/bin/cronjob_bandit24.sh

mkdir /tmp/KJG3

cd /tmp/KJG3

vi dump.sh

내용

#!/bin/bash
cat /etc/bandit_pass/bandit24 > /tmp/KJG3/pass.txt

chmod 777 dump.sh

chmod 777 /tmp/KJG3

cp - r dump.sh /var/spool/foo

VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar

 

24  mkdir /tmp/KJG24

vi s.sh

내용

#! /bin/bash
pass="VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar"
for i in {0..9}{0..9}{0..9}{0..9}
do
        echo "$pass $i" >> password.txt
done
bash s.sh

cat password.txt | nc localhost 30002

p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d

 

25 ssh -i bandit26.sshkey bandit26@localhost -p 2220

grep bandit26 /etc/passwd

cat /usr/bin/showtext

터미널 창을 아주 작게 줄여서

ssh -i bandit26.sshkey bandit26@localhost -p 2220

v를 누르면 vi가 실행

:r /etc/bandit_pass/bandit26

c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1

 

<참고> 26접속법

vi에서

:set shell=/bin/bash

:sh

 

26  ./bandit27-do cat /etc/bandit_pass/bandit27

YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS

 

27 

mkdir /tmp/KJG5

cd /tmp/KJG5

git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repo

YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS 입력

ls

cd repo

cat README

AVanL161y9rsbcJIsFHuw35rjaOM19nR

 

28  동일

git log

git show [fix info leak 부분의 commit 코드]

tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S

 

29  동일

git branch -r

git checkout dev

cat README.md

xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS

 

30  동일

git tag

git show secret

OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt

 

31 동일

echo "May I come in?" > key.txt

cat ./.gitignore

git add -f key.txt

git commit -m 'key add'

git push origin master

rmCBvG56y58BXzv98yZGdO7ATVL5dW8y

 

32 $0은 명령행 인자로 셸스크립트의 이름을 담는 것 [대문자 세상이기 때문에 소문자 사용 불가능]

$0

bash

cat /etc/bandit_pass/bandit33

odHo63fHiFqcWWJG9rLiLDtPm45KzUKy