Bandit level 6

Bandit 6

Level Goal

The password for the next level is stored somewhere on the server and has all of the following properties:

• owned by user bandit7
• owned by group bandit6
• 33 bytes in size

Commands you may need to solve this level

ls, cd, cat, file, du, find, grep

Somewhere on the server? I didn't read the instructions all that well, I knew the user and the group switch before this for the find command but forgot what the size switch for bytes was. Now if I didn't write this blog and have that documentation, I would have had to read the man page for "find" again!

bandit6@bandit:~$ ls
bandit6@bandit:~$ find ./* -user bandit7 -group bandit6 -size 33c
find: `./*': No such file or directory

Weird it's not in our current directory,after realizing there was nothing in the directory and looking at the instructions about being somewhere on the server I tried this.

bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c
find: `/var/log': Permission denied
/var/lib/dpkg/info/bandit7.password
find: `/var/lib/php5': Permission denied
...
find: `/proc/144/fd/5': No such file or directory
find: `/proc/144/fdinfo/5': No such file or directory

There is a pretty large output here but in the first couple results I spot something! The only reason I did was because I documented everything for us! The file path here seems interesting

/var/lib/dpkg/info/bandit7.password

If a gift horse spits on your shoes are you going to just ignore it? Nah, lets roll with this

bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs
bandit6@bandit:~$ exit
logout
Connection to bandit.labs.overthewire.org closed.
root@kali:~# 

Cool beans. We got lucky though. For the sake of being a completionist I looked for and found a better solution, another blog has this solution on their page

bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c | 2> /dev/null

/dev/null is like a black hole. You know it exists, but you cannot communicate with it. It has no output, only input. It swallows all data it can possibly get and nobody knows what it looks inside.

So we pipe/send the results of our command with "|" operator to a directory called /dev/null.While /dev/null is fairly simple concept to understand, it's a place we banish things we don't want to see, nothing comes back, we throw anything we don't want in there.

So what does the "2>" mean? Well there are three options for this, its called a file descriptor. While I could not find a good resource on how to explain these I'll do my best.

0,1, & 2 are all standard POSIX file descriptors that generally works on most platforms from bash ( (the linux shell language we've been learning here) , to assembly, .net framework, etc. It's been around since the 1950's. They describe standard streams which are preconnected input and output (I/O = input/output) communication channels between a computer program and its environment when it begins execution.

The three I/O streams are as follows:

• 0 - which represents standard input  otherwise known as stdin
• 1 - which represents standard ouput otherwise known as stdout
• 2 - which represents standard error otherwise know as stderr 

See what I'm getting at? So this is a bit beyond the scope of information for this level. Basically use "find" to get results, which then pipes all information coming across the error stream to /dev/null, which is the "permission denied" and "no such file or directory" or any other results that trigger an error to get a neat, singular output for the one file we wanted.