Linux Command Learning (Bandit - OverTheWire)

Source : axcheron.github.io

The Bandit wargame is an online game offered by the OverTheWire community. It helps you to learn various Linux commands and understand some basic features of this system.

This is a quick write-up of my solutions for this challenge. I advise you do it yourself before looking at the solutions as you won’t learn anything without trying. My goal here is simply to show you how I did it and compare your solutions with mine.

Note: You should follow this write-up with the official website open as it gives details on the goal of each challenges and some helpful material to read.

Bandit 00 Solution

The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. The password for the next level is stored in a file called readme located in the home directory.

$ ssh [email protected] -p 2220

$ ls -la
total 24
drwxr-xr-x  2 root    root    4096 Oct 16 14:00 .
drwxr-xr-x 41 root    root    4096 Oct 16 14:00 ..
-rw-r--r--  1 root    root     220 May 15  2017 .bash_logout
-rw-r--r--  1 root    root    3526 May 15  2017 .bashrc
-rw-r--r--  1 root    root     675 May 15  2017 .profile
-rw-r-----  1 bandit1 bandit0   33 Oct 16 14:00 readme
bandit0@bandit:~$ cat readme
boJ9jbbUNNfktd78OOpsqOltutMc3MY1

Explanation: Here, you just need to read the content of the readme file with the command cat.

Bandit 01 Solution

The password for the next level is stored in a file called - located in the home directory.

Explanation: As ’-‘ means reading from/to stdin in a shell, you need to specify a path to read the file. If you don’t specify the path, cat will read from stdin and print back your input.

Bandit 02 Solution

The password for the next level is stored in a file called spaces in this filename located in the home directory.

Explanation: You can also read the file by escaping the spaces using backslash (’\‘) like the following command: cat spaces\ in\ this\ filename.

Bandit 03 Solution

The password for the next level is stored in a hidden file in the inhere directory.

Explanation: In the Linux operating system, a hidden file is any file that begins with a ”.”. When a file is hidden it can not been seen with the bare ls command. If you need to see hidden files using the ls command you need to add the -a switch.

Bandit 04 Solution

The password for the next level is stored in the only human-readable file in the inhere directory.

Explanation: Here, we use the file command with a wildcard on the filename to find the file containing only ASCII text.

Bandit 05 Solution

The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties:

  • Human-readable

  • 1033 bytes in size

  • not executable

Explanation: The find command is really useful when you look for a specific file. Here, we use the -readable, ! -executable and -size 1033c parameters to find a file with the specified properties.

Bandit 06 Solution

The password for the next level is stored somewhere on the server and has all of the following properties:

  • Owned by user bandit7

  • Owned by group bandit6

  • 33 bytes in size

Explanation: Same as the previous level except that we redirect the files we cannot read to stderr. Also we tell find to look into the root of the file system as we don’t know where the file is located.

Bandit 07 Solution

The password for the next level is stored in the file data.txt next to the word millionth.

Explanation: Here we use the -exec argument of find with the grep command to find the file containing the word millionth.

Bandit 08 Solution

The password for the next level is stored in the file data.txt and is the only line of text that occurs only once.

Explanation: First we use sort to sort alphabetically the data in the data.txt file then, we use uniq to count the number or occurances and find the line of text that occurs only once.

Bandit 09 Solution

The password for the next level is stored in the file data.txt in one of the few human-readable strings, beginning with several ‘=’ characters.

Explanation: The strings command helps us to find the human-readable strings and then grep the strings beginning with several ‘=’ characters.

Bandit 10 Solution

The password for the next level is stored in the file data.txt, which contains base64 encoded data.

Explanation: Read the data.txt and redirect the output to the base64 command. The -d argument is used to decode the string.

Bandit 11 Solution

The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions.

Explanation: The tr command is used to translate the first set of characters ‘A-Za-z’ to ‘N-ZA-Mn-za-m’ which is a rotation of 13 positions of the first set.

Bandit 12 Solution

The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed.

Explanation: The -r switch of xxd convert an hexdump to binary. Then we use the file command to find out which compression tool has been used and recursively decompress the files with the right tool.

Bandit 13 Solution

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level.

Explanation: Here, we download the private key to login to the next level. The scp command will do the trick.

Bandit 14 Solution

The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.

Explanation: After login to bandit14 with the private key, you can redirect the content of /etc/bandit_pass/bandit14 to netcat using the nc command.

Bandit 15 Solution

The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Explanation: Here, we send the content of /etc/bandit_pass/bandit15 to openssl. The s_client implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking SSL/TLS.

Bandit 16 Solution

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Explanation: You can write a simple port scanner in bash and try to connect to the open ports with openssl.

Bandit 17 Solution

There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new

Explanation: The diff command will compare 2 files line by line and show you the differences.

Bandit 18 Solution

The password for the next level is stored in a file readme in the homedirectory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.

Explanation: You can pass the command you want to execute directly to the ssh command to bypass the issue.

Bandit 19 Solution

To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.

Explanation: Nothing to explain here, pretty straightforward.

Bandit 20 Solution

There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21).

Explanation: I suggest you open 2 terminals. Set a listener in the first one and try to connect in the second one. The password should appear in your first terninal.

Bandit 21 Solution

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

Explanation: Just read the cronjob_bandit22.sh script executed by cron. You’ll see where the password will be stored.

Bandit 22 Solution

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

Explanation: The script tells us that the file where the password will be stored is an md5 hash. You can compute the hash using the md5sum command and retrieve the content of the file.

Bandit 23 Solution

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

Explanation: The cron script execute and delete all scripts in /var/spool/bandit24. We just need to write our own script, copy it in /var/spool/bandit24 and wait for the result.

Bandit 24 Solution

A daemon is listening on port 30002 and will give you the password for bandit25 if given the password for bandit24 and a secret numeric 4-digit pincode. There is no way to retrieve the pincode except by going through all of the 10000 combinations, called brute-forcing.

Note: After multiple attempts, I didn’t found a valid solution yet. Still working on a viable script. This works:(by @rvrheenen)

This basic idea is creating a dictionary first and then transmit it to the port. A good way!

Bandit 25 & 26 Solution

Logging in to bandit26 from bandit25 should be fairly easy… The shell for user bandit26 is not /bin/bash, but something else. Find out what it is, how it works and how to break out of it.

Note: We will solve Bandit 25 & 26 in this section.

Now, as we already have a shell using vi, we can get the password for level 27.

Explanation: In the first part we figure that the fake shell read a file with more and exit. As the content of the file is not long enough, we need to reduce the size of the terminal to enable more to paging through text one screenful at a time. Once more is running we can type v to open vi and execute command through that tool. Same thing for the second part except the bandit27-do command will give us the password.

Bandit 27 Solution

There is a git repository at ssh://bandit27-git@localhost/home/bandit27-git/repo. The password for the user bandit27-git is the same as for the user bandit27.

Explanation: You just need to create a temporary folder in /tmp/ and clone the repo. Inside the repo, you’ll find the password.

Bandit 28 Solution

There is a git repository at ssh://bandit28-git@localhost/home/bandit28-git/repo. The password for the user bandit28-git is the same as for the user bandit28.

Explanation: You need to create a temporary folder in /tmp/ and clone the repo. Then, to reveal the password you need to checkout an older commit.

Bandit 29 Solution

There is a git repository at ssh://bandit29-git@localhost/home/bandit29-git/repo. The password for the user bandit29-git is the same as for the user bandit29.

Explanation: You need to create a temporary folder in /tmp/ and clone the repo. Then, to reveal the password you need to checkout the dev branch.

Bandit 30 Solution

There is a git repository at ssh://bandit30-git@localhost/home/bandit30-git/repo. The password for the user bandit30-git is the same as for the user bandit30.

Explanation: You need to create a temporary folder in /tmp/ and clone the repo. git show will display the tag message and the referenced objects to reveal the password.

Bandit 31 Solution

There is a git repository at ssh://bandit31-git@localhost/home/bandit31-git/repo. The password for the user bandit31-git is the same as for the user bandit31.

Explanation: You need to create a temporary folder in /tmp/ and clone the repo. Then, we just follow the instruction in the README.md. Push a file called key.txt, add the file and push it to the master branch.

Bandit 32 Solution

After all this git stuff its time for another escape.

Explanation: Here we get an interactive shell by inserting $0 in the fake shell, then we run vim end read the password for the next level.

Bandit 33 Solution (The End)

This one is not really a challenge as there are no more levels to play in this game. But we can still try to login to check the password we found previously.

Good job, you did it ! I Hope you enjoyed this write-up ;)

PreviousLinux Command IntroNextVA-PT Cheatsheet

Last updated

Was this helpful?