bandit4@bandit:~/inhere$ file ./-file* ./-file00: data ./-file01: data ./-file02: data ./-file03: data ./-file04: data ./-file05: data ./-file06: data ./-file07: ASCII text ./-file08: data ./-file09: data bandit4@bandit:~/inhere$ cat ./-file07 koReBOKuIDDepwhWk7jZC0RTdopnAYKh
Starting Nmap 7.40 ( https://nmap.org ) at 2020-05-17 09:18 CEST Nmap scan report for localhost (127.0.0.1) Host is up (0.00028s latency). Not shown: 996 closed ports PORT STATE SERVICE 31046/tcp open unknown 31518/tcp open unknown 31691/tcp open unknown 31790/tcp open unknown 31960/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds ------------------------------------------------------------------------------- bandit16@bandit:~$ nmap -sV -p 31000-32000 localhost
Starting Nmap 7.40 ( https://nmap.org ) at 2020-05-17 09:34 CEST Nmap scan report for localhost (127.0.0.1) Host is up (0.00025s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 31046/tcp open echo 31518/tcp open ssl/echo 31691/tcp open echo 31790/tcp open ssl/unknown 31960/tcp open echo 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port31790-TCP:V=7.40%T=SSL%I=7%D=5/17%Time=5EC0E90B%P=x86_64-pc-linux-g SF:nu%r(GenericLines,31,"Wrong!\x20Please\x20enter\x20the\x20correct\x20cu SF:rrent\x20password\n")%r(GetRequest,31,"Wrong!\x20Please\x20enter\x20the SF:\x20correct\x20current\x20password\n")%r(HTTPOptions,31,"Wrong!\x20Plea SF:se\x20enter\x20the\x20correct\x20current\x20password\n")%r(RTSPRequest, SF:31,"Wrong!\x20Please\x20enter\x20the\x20correct\x20current\x20password\ SF:n")%r(Help,31,"Wrong!\x20Please\x20enter\x20the\x20correct\x20current\x SF:20password\n")%r(SSLSessionReq,31,"Wrong!\x20Please\x20enter\x20the\x20 SF:correct\x20current\x20password\n")%r(TLSSessionReq,31,"Wrong!\x20Please SF:\x20enter\x20the\x20correct\x20current\x20password\n")%r(Kerberos,31,"W SF:rong!\x20Please\x20enter\x20the\x20correct\x20current\x20password\n")%r SF:(FourOhFourRequest,31,"Wrong!\x20Please\x20enter\x20the\x20correct\x20c SF:urrent\x20password\n")%r(LPDString,31,"Wrong!\x20Please\x20enter\x20the SF:\x20correct\x20current\x20password\n")%r(LDAPSearchReq,31,"Wrong!\x20Pl SF:ease\x20enter\x20the\x20correct\x20current\x20password\n")%r(SIPOptions SF:,31,"Wrong!\x20Please\x20enter\x20the\x20correct\x20current\x20password SF:\n");
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 88.00 seconds ------------------------------------------------------------------------ bandit16@bandit:~$ mkdir /tmp/bling2/ bandit16@bandit:~$ echo "cluFn7wTiGryunymYOu4RcffSxQluehd" | openssl s_client -connect localhost:31790 -quiet 2>/dev/null | tail -n 28 > /tmp/bling2/ssh.private ----------------------------------------------------------------------- ssh -i ssh.private bandit17@localhost cat /etc/bandit_pass/bandit17
bling@bling:~$ ssh bandit18@bandit.labs.overthewire.org -p 2220 "cat readme" This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
cd /var/spool/$myname echo "Executing and deleting all scripts in /var/spool/$myname:" for i in * .*; do if [ "$i" != "." -a "$i" != ".." ]; then echo "Handling $i" owner="$(stat --format "%U" ./$i)" if [ "${owner}" = "bandit23" ]; then timeout -s 9 60 ./$i fi rm -f ./$i fi done
bandit24@bandit:/tmp/bling4$ vim test.py -------------------- #!/usr/bin/env python f = open('test.txt','w') for i in range(10000): payload = "UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ" + " " + str(i).zfill(4) + '\n' f.write(payload) f.close() -------------------- bandit24@bandit:/tmp/bling4$ python test.py bandit24@bandit:/tmp/bling4$ nc localhost 30002 < /tmp/bling4/test.txt > /tmp/bling4/result.txt bandit24@bandit:/tmp/bling4$ sort ./result.txt | uniq -u
Correct! Exiting. I am the pincode checker for user bandit25. Please enter the password for user bandit24 and the secret pincode on a single line, separated by a space. The password of user bandit25 is uNG9O58gUE7snukf3bvZ0rxhtnjzSGzG
bandit27@bandit:~$ mkdir /tmp/bling bandit27@bandit:~$ cd /tmp/bling bandit27@bandit:/tmp/bling$ git clone ssh://bandit27-git@localhost/home/bandit27-git/repo Cloning into 'repo'... Could not create directory '/home/bandit27/.ssh'. The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc. Are you sure you want to continue connecting (yes/no)? yes Failed to add the host to the list of known hosts (/home/bandit27/.ssh/known_hosts). This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit27-git@localhost's password: remote: Counting objects: 3, done. remote: Compressing objects: 100% (2/2), done. remote: Total 3 (delta 0), reused 0 (delta 0) Receiving objects: 100% (3/3), done. bandit27@bandit:/tmp/bling$ ls repo bandit27@bandit:/tmp/bling$ cd repo bandit27@bandit:/tmp/bling/repo$ ls README bandit27@bandit:/tmp/bling/repo$ cat README The password to the next level is: 0ef186ac70e04ea33b4c1853d2526fa2
commit de2ebe2d5fd1598cd547f4d56247e053be3fdc38 Author: Ben Dover <noone@overthewire.org> Date: Thu May 7 20:14:49 2020 +0200
initial commit of README.md
bandit28@bandit:/tmp/bling28/repo$ git reset --hard c086d11a00c0648d095d04c089786efef5e01264 HEAD is now at c086d11 add missing data bandit28@bandit:/tmp/bling28/repo$ cat README.md # Bandit Notes Some notes for level29 of bandit.
拉下repo后： bandit29@bandit:/tmp/bling29/repo$ git branch -a * master remotes/origin/HEAD -> origin/master remotes/origin/dev remotes/origin/master remotes/origin/sploits-dev bandit29@bandit:/tmp/bling29/repo$ git checkout origin/dev Previous HEAD position was 786d5be... add some silly exploit, just for shit and giggles HEAD is now at bc83328... add data needed for development bandit29@bandit:/tmp/bling29/repo$ cat README.md # Bandit Notes Some notes for bandit30 of bandit.
将repo拉到本地后： bandit31@bandit:/tmp/bling31/repo$ ls -al total 20 drwxr-sr-x 3 bandit31 root 4096 May 17 15:00 . drwxr-sr-x 3 bandit31 root 4096 May 17 14:59 .. drwxr-sr-x 8 bandit31 root 4096 May 17 15:00 .git -rw-r--r-- 1 bandit31 root 6 May 17 15:00 .gitignore -rw-r--r-- 1 bandit31 root 147 May 17 15:00 README.md bandit31@bandit:/tmp/bling31/repo$ echo "May I come in?" > key.txt bandit31@bandit:/tmp/bling31/repo$ git add -f key.txt bandit31@bandit:/tmp/bling31/repo$ git status On branch master Your branch is up-to-date with 'origin/master'. Changes to be committed: (use "git reset HEAD <file>..." to unstage)
new file: key.txt
bandit31@bandit:/tmp/bling31/repo$ git commit -m "add" [master 93d69fa] add 1 file changed, 1 insertion(+) create mode 100644 key.txt bandit31@bandit:/tmp/bling31/repo$ git push origin master Could not create directory '/home/bandit31/.ssh'. The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc. Are you sure you want to continue connecting (yes/no)? yes Failed to add the host to the list of known hosts (/home/bandit31/.ssh/known_hosts). This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit31-git@localhost's password: Counting objects: 3, done. Delta compression using up to 2 threads. Compressing objects: 100% (2/2), done. Writing objects: 100% (3/3), 315 bytes | 0 bytes/s, done. Total 3 (delta 0), reused 0 (delta 0) remote: ### Attempting to validate files... #### remote: remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo. remote: remote: Well done! Here is the password for the next level: remote: 56a9bf19c63d650ce78e6ec0354ee45e remote: remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo. remote: To ssh://localhost/home/bandit31-git/repo ! [remote rejected] master -> master (pre-receive hook declined) error: failed to push some refs to 'ssh://bandit31-git@localhost/home/bandit31-git/repo'