Secure Universal Cyber Kittens (S.U.C.K)

Bandit 15 Level Goal The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption. Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command… Commands you may need to solve this level ssh, telnet, nc, openssl, s_client, nmap Helpful Reading Material Secure Socket Layer/Transport Layer Security on Wikipedia OpenSSL Cookbook - Testing with OpenSSL Last time on bandit! : BfMYroe26WYalil77FoDi9qh59eK5xNr So our next thing, we need to read two things, it's pretty obviously hinting that we should use ssl, and by luck! We've got a command called "openssl" lets look at that first, which I found here . So first of all the synopsis: openssl command [ command_opts ] [ command_args ] openssl [ list-standard-comman

Bandit level 14

Bandit 14 Level Goal The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost . Commands you may need to solve this level ssh, telnet, nc, openssl, s_client, nmap Helpful Reading Material How the Internet works in 5 minutes (YouTube) (Not completely accurate, but good enough for beginners) IP Addresses IP Address on Wikipedia Localhost on Wikipedia Ports Port (computer networking) on Wikipedia Okay so I know telnet doesn't have authentication. I know I'm probably using that so I check the man page. Synopsis telnet [ -8EFKLacdfrx ] [ -X authtype ] [ -b hostalias ] [ -e escapechar ] [ -k realm ] [ -l user ] [ -n tracefile ] [ host [ port ]] Okay so the command will be "telnet localhost 30000", remember those instructions from the previous level on where that password was? Neither do , lets read it again! "The pa

Bandit 13

Bandit 13 The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14 . For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on Commands you may need to solve this level ssh, telnet, nc, openssl, s_client, nmap Helpful Reading Material SSH/OpenSSH/Keys So the link provided kind of sucked for telling us what we need here, if you don't know already, RTFM. Looking at the man page we see a switch for ssh. ... SYNOPSIS ssh [ -1246AaCfGgKkMNnqsTtVvXxYy ] [ -b bind _ address ] [ -c cipher _ spec ] [ -D [ bind _ address :] port ] [ -E log _ file ] [ -e escape _ char ] [ -F configfile ] [ -I pkcs11 ] [ -i identity _ file ] [ -L address ] [ -l login _ name ] [ -m mac _ spec ] [ -O ctl _ cmd ] [ -o option ] [ -p port ] [ -Q query _ option ] [ -R

Bandit 12

Bandit 12 bandit12@bandit:~$ ls data.txt bandit12@bandit:~$ mkdir data bandit12@bandit:~$ cp data.txt ./data bandit12@bandit:~$ cd data bandit12@bandit:~/data$ ls data.txt bandit12@bandit:~/data$ file data.txt data.txt: ASCII text 0000000: 1f8b 0808 4572 4259 0203 6461 7461 322e ....ErBY..data2. 0000010: 6269 6e00 0143 02bc fd42 5a68 3931 4159 bin..C...BZh91AY 0000020: 2653 59a3 fd61 8800 0019 ffff dffb 1ff5 &SY..a.......... 0000030: f7d7 dfdb fe4f ffb3 b5f7 ffdf b2d8 fefb .....O.......... 0000040: e7dd fffa fefd 7f7b d1fb fe3f b001 3b56 .......{...?..;V 0000050: a106 81a0 1a00 07a8 0068 01a1 a69a 0000 .........h...... 0000060: d1a0 d034 6868 34f5 0641 a000 000d 000f ...4hh4..A...... 0000070: 5064 00d0 321a 69e9 0323 1a27 a883 4003 Pd..2.i..#.'..@. 0000080: 41a0 01ea 0000 0003 4000 0068 7a4f 4800 A.......@..hzOH. 0000090: 0c8c 803d 41a0 64d1 a3d4 d1a3 6a68 01a0 ...=A.d.....jh.. 00000a0: 34da 8340 003d 4347 a83a 69a6 8699 0034 4..@.=CG.:i....4 00000b0: 3203 4610 3

Bandit 11

Bandit 11 The transformation can be done using a lookup table, such as the following: Input ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz Output NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm But we do not actually need to know this, head to that wiki link. It will give you the answer in an example The ROT13 and ROT47 are fairly easy to implement using the Unix terminal application tr; to encrypt the string "The Quick Brown Fox Jumps Over The Lazy Dog" in ROT13: $ # Map upper case A-Z to N-ZA-M and lower case a-z to n-za-m $ echo "The Quick Brown Fox Jumps Over The Lazy Dog" | tr 'A-Za-z' 'N-ZA-Mn-za-m' Gur Dhvpx Oebja Sbk Whzcf Bire Gur Ynml Qb So this has an echo command, I don't know why, and even though knowing everything can help, doesn't mean we need to. I tried tr 'A-Za-z' 'N-ZA-Mn-za-m' data.txt This didn't work, "tr" seems to rotate the characters in context of the exa

Bandit 10

bandit 10 bandit10@bandit:~$ ls data.txt bandit10@bandit:~$ cat data.txt VGhlIHBhc3N3b3JkIGlzIElGdWt3S0dzRlc4TU9xM0lSRnFyeEUxaHhUTkViVVBSCg== bandit10@bandit:~$ base64 -d data.txt The password is IFukwKGsFW8MOq3IRFqrxE1hxTNEbUPR Nice "base64 -d" is the command we need. "-d" here obviously stands for 'decode'

Bandit 9

Bandit 9 bandit9@bandit:~$ ls data.txt bandit9@bandit:~$ grep data.txt '===' grep: ===: No such file or directory bandit9@bandit:~$ strings data.txt | grep '===' J========== the ========== password ========== is W========== truKLdjsbJ5g7yyJ2X2R0o3a5HQJFuLk bandit9@bandit:~$ DONE, READ THOSE INSTRUCTIONS FOR HINTS, INFORMATION IS VALUABLE Glowfish Contrast

Bandit 8

Bandit 8 bandit8@bandit:~$ ls data.txt bandit8@bandit:~$ sort data.txt | uniq -u UsvVyFSfZZWbi6wgC7dAFyFuR6jQQUhR bandit8@bandit:~$ Glowfish Contrast

Bandit 7

Bandit 7 I wish I didnt feel so cruddy bandit7@bandit:~$ ls data.txt bandit7@bandit:~$ cat data.txt cardinals CAw2INEcfQXgeU9pJo2sblodpZAlJPFc intending Qr2KViD9ulk1UJuPwi1OQ0XwFLSNjWi1 absorbs 2e4afAv6hGQenW7fhqJrIB1u7txUJQ5k ... enumerable 3cNAcvD2jNnnHtlHuADdjcCl9lEpUQre nonfatal bjxaP056aQtdfFofagtsYNuYu1E2Cdzf vicinity's iR6NdwRFD9hQsFTHLDDpnqMbeT5yP4Rn rosin DyinTKcvwMTLQNEn5dWEir2chv29CS9g bandit7@bandit:~$ that is a lot to search through and I am lazy, but I want to do a lot. Being efficient is the best way to be lazy and accomplish your goals, remember, get what you need done but don't try to hard! bandit7@bandit:~$ cat data.txt | grep millionth millionth cvX2JJa4CFALtqS87jk27qwqGhBM9plV bandit7@bandit:~$ Glowfish Contrast

Bandit level 6

Bandit 6 Level Goal The password for the next level is stored somewhere on the server and has all of the following properties: owned by user bandit7 owned by group bandit6 33 bytes in size Commands you may need to solve this level ls, cd, cat, file, du, find, grep Somewhere on the server? I didn't read the instructions all that well, I knew the user and the group switch before this for the find command but forgot what the size switch for bytes was. Now if I didn't write this blog and have that documentation, I would have had to read the man page for "find" again! bandit6@bandit:~$ ls bandit6@bandit:~$ find ./* -user bandit7 -group bandit6 -size 33c find: `./*': No such file or directory Weird it's not in our current directory,after realizing there was nothing in the directory and looking at the instructions about being somewhere on the server I tried this. bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c find: `/var/log&

Bandit 5

Bandit 5 Level Goal The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties: human-readable 1033 bytes in size not executable Commands you may need to solve this level ls, cd, cat, file, du, find If you happen to be solving this one on your own, we need to check the man page for it. We need to find the file that has a size of 1033 bytes. We need to indicate it with the size switch and use the 1033c in which the c indicates the number of bytes bandit5@bandit:~$ ls inhere bandit5@bandit:~$ cd ./inhere bandit5@bandit:~/inhere$ ls maybehere00 maybehere04 maybehere08 maybehere12 maybehere16 maybehere01 maybehere05 maybehere09 maybehere13 maybehere17 maybehere02 maybehere06 maybehere10 maybehere14 maybehere18 maybehere03 maybehere07 maybehere11 maybehere15 maybehere19 bandit5@bandit:~/inhere$ find -size 1033c ./maybehere07/.file2 bandit5@bandit:~/inhere$ cat ./maybehere07/.

Bandit level 4

Bandit 4 Level Goal The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the “reset” command. Commands you may need to solve this level ls, cd, cat, file, du, find bandit4@bandit:~$ ls inhere bandit4@bandit:~$ cd ./inhere bandit4@bandit:~/inhere$ ls -file00 -file02 -file04 -file06 -file08 -file01 -file03 -file05 -file07 -file09 bandit4@bandit:~/inhere$ file ./* ./-file00: data ./-file01: data ./-file02: data ./-file03: data ./-file04: data ./-file05: data ./-file06: data ./-file07: ASCII text ./-file08: data ./-file09: data bandit4@bandit:~/inhere$ cat ./-file07 koReBOKuIDDepwhWk7jZC0RTdopnAYKh Glowfish Contrast

Bandit level 3

Bandit 3 The instructions: Level Goal The password for the next level is stored in a hidden file in the inhere directory. Commands you may need to solve this level ls, cd, cat, file, du, find bandit3@bandit:~$ bandit3@bandit:~$ ls inhere bandit3@bandit:~$ cd ./inhere bandit3@bandit:~/inhere$ ls bandit3@bandit:~/inhere$ ls -als total 12 4 drwxr-xr-x 2 root root 4096 Jun 15 11:41 . 4 drwxr-xr-x 4 bandit3 bandit3 4096 Aug 19 23:32 .. 4 -rw-r----- 1 bandit4 bandit3 33 Jun 15 11:41 .hidden bandit3@bandit:~/inhere$ cat ./.hidden pIwrPrtPN36QITSp3EQaw936yaFoFgAB Okay so this all is pretty easy, we don't get our first taste of something interesting until a few levels in. So we display the contents of our working directory. We see a folder called "inhere" and then use "cd" to change directories into that folder. Once inside we try to display the contents of that directory, which comes up with nothing. I add a couple of switches to our

Bandit Level 2

Bandit 2 root@kali:~# ssh bandit2@bandit.labs.overthewire.org -p 2220 _ _ _ _ | |__ __ _ _ __ __| (_) |_ | '_ \ / _` | '_ \ / _` | | __| | |_) | (_| | | | | (_| | | |_ |_.__/ \__,_|_| |_|\__,_|_|\__| a http://www.overthewire.org wargame. bandit2@bandit.labs.overthewire.org's password: Welcome to Ubuntu 14.04 LTS (GNU/Linux 4.4.0-71-generic x86_64) * Documentation: https://help.ubuntu.com/ The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. bandit2@bandit:~$ ls spaces in this filename bandit2@bandit:~$ cat ./'spaces in this filename' UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK This is the last time I'll leave in how to ssh into a device. The 'ls' command list the contents of our dire

Bandit Level 1

Bandit 1 We just got the password for level one and are now logging in. I got sick of PuTTY and VM'ed kali really quickly. root@kali:~# ssh bandit1@bandit.labs.overthewire.org -p 2220 The authenticity of host '[bandit.labs.overthewire.org]:2220 ([176.9.9.172]:2220)' can't be established. ECDSA key fingerprint is SHA256:SCySwNrZFEHArEX1cAlnnaJ5gz2O8VEigY9X80nFWUU. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[bandit.labs.overthewire.org]:2220,[176.9.9.172]:2220' (ECDSA) to the list of known hosts. _ _ _ _ | |__ __ _ _ __ __| (_) |_ | '_ \ / _` | '_ \ / _` | | __| | |_) | (_| | | | | (_| | | |_ |_.__/ \__,_|_| |_|\__,_|_|\__| a http://www.overthewire.org wargame. bandit1@bandit.labs.overthewire.org's password: Welcome to Ubuntu 14.04 LTS (GNU/Linux 4.4.0-71-generic x86_64) * Documentation: https://help.ubuntu.com/ The programs included wi

Bandit level 0