Challenge Information

Platform: OverTheWire
Wargame: Bandit
Levels: 09-16

Level 09

Objective: The password for the next level is stored in the file data.txt in one of the few human-readable strings, preceded by several = characters.

Solution: We use the strings command to extract printable characters from the binary file, then pipe the output to grep to locate the password.

# Extract printable strings and search for patterns with multiple equals signs
strings data.txt | grep -E '===+'
Listing 1 - Searching for human-readable text patterns

Level 10

Objective: The password for the next level is stored in the file data.txt, which contains base64-encoded data.

Solution: We decode the file using the base64 command with the -d flag.

# Decode base64-encoded data
cat data.txt | base64 -d
Listing 2 - Base64 decoding

Level 11

Objective: The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions.

Solution: We apply a ROT-13 transformation using the tr command to shift each letter by 13 places in the alphabet.

# Apply ROT-13 transformation
cat data.txt | tr 'A-Za-z' 'N-ZA-Mn-za-m'
Listing 3 - ROT-13 decryption with tr

Level 12

Objective: The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed.

For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: ‘mkdir /tmp/myname123’. Then copy the datafile using cp, and rename it using mv (read the manpages!).

Solution: First, we reverse the hexdump using xxd -r. Because the file has been compressed multiple times, we then iteratively examine the file with the file command to identify each compression layer and extract accordingly.

For example: xxd -r data.txt > /tmp/myname123/data.bin and then file data.bin.

Alternatively, if the compression layers are known, they can be piped sequentially:

xxd -r data.txt | gzip --decompress | bzip2 --decompress | gzip --decompress | tar xvO | tar xvO | bzip2 --decompress | tar xvO | gzip -d | cat
Listing 4 - Reversing hexdump and decompressing multiple layers

Level 13

Objective: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level.

Note: localhost is a hostname that refers to the machine you are working on.

Solution: We copy the private SSH key to our local machine, set the appropriate permissions, and use it to authenticate as bandit14.

First, display and copy the private key:

# Display the private key
cat sshkey.private

# Exit the SSH session
exit
Listing 5 - Copying the private SSH key

Next, on our local machine, we restrict the key’s permissions and use it to connect:

# Set restrictive permissions (required for SSH keys)
chmod 0400 <sshkey.private>

# Connect using the private key
ssh -i sshkey.private [email protected] -p 2220

# Retrieve the password from the protected file
cat /etc/bandit_pass/bandit14
Listing 6 - SSH authentication with a private key

Level 14

Objective: The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.

Solution: We use Netcat (nc) to establish a TCP connection to the service and submit the current password.

nc -vn 127.0.0.1 30000
# or
nc -v localhost 30000

# Paste the current level's password to receive the next password
Listing 7 - Connecting to a port with Netcat

Level 15

Objective: The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Note: Getting HEARTBEATING and Read R BLOCK? Use -ign_eof and read the CONNECTED COMMANDS section in the manpage. Next to R and Q, the B command also works in this version of that command…

Solution: We use the OpenSSL client to connect to the SSL-encrypted service.

openssl s_client -connect localhost:30001 -ign_eof

# Paste the current level's password to receive the next password
Listing 8 - SSL-encrypted communication with OpenSSL

Level 16

Objective: The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000.

First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Solution: First, we scan the port range to identify listening services:

nmap localhost -p 31000-32000
Listing 9 - Scanning a port range

Next, we perform a version scan on the open ports to determine which services use SSL:

nmap -n localhost -p 31046,31518,31691,31790,31960 -sV --version-light
Listing 10 - Service version detection scan

Finally, we connect to the SSL-enabled service (port 31790) and submit the password to receive an SSH private key for the next level:

openssl s_client -connect localhost:31790 -ign_eof

# Paste the current level's password
# Copy the private key that is returned
exit
Listing 11 - Retrieving credentials via SSL