[OverTheWire] Bandit Level 20 → 21

https://overthewire.org/wargames/bandit/bandit21.html

Goal

There is a setuid binary in the home directory that does the following:

1. It makes a connection to localhost on the port you specify as a command line argument.

2. It then reads a line of text from the connection and compares it to the password in the previous level (bandit**20**). If the password is correct, it will transmit the password for the next level (bandit**21**).

Note: Try connecting to your own network daemon to see if it works as you think.

Possible commands to solve this level

*ssh, `nc*,cat`, *bash, `screen*,tmux`, *Unix Job Control*

Note : Not all commands listed above is need

┌──────────────────┬───────────────────────────────────────────┐
│     Command      │                Explanation                │
├──────────────────┼───────────────────────────────────────────┤
│ ssh              │ OpenSSH SSH client (remote login program) │
│ nc               │ TCP/IP swiss army knife                   │
│ cat              │ Concatenate files & print on the stdout   │
│ bash             │ GNU Bourne-Again Shell                    │
│ screen           │ Screen manager with terminal emulation    │
│ tmux             │ Terminal multiplexer                      │
│ Unix job control │ Unix job control command list             │
└──────────────────┴───────────────────────────────────────────┘

Write up

Information

Host Name : bandit.labs.overthewire.org
Username : bandit20
Password : GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Port Number : 2220

To find the password for Level 21

[# Step 1]: Connect and login to the account with the username & password stated above.

[# Step 2]: Run **ls **-l in the current working directory, to identify the file with a “setuid” file permission setting.

[Note]:

When you first login, your current working directory is your home directory. Your home directory has the same name as your username. For example, *ee91ab*, and it is where your personal files and subdirectories are saved.

As mentioned in the previous level, in the image above, the file suconnect, has an **s bit located in the “User” permission classes. Hence, this is the file we are finding with the setuid binary** permission set.

Additionally, the owner of the file suconnect is bandit**21. The red highlight signifies that this file has elevated permissions. Hence, any commands executing with `./suconnectwill run as userbandit21** instead ofbandit20`.

[# Step 3]: Run **./**suconnect command, to understand the program & how to use it to retrieve bandit**21**’s password.

Thus, this level requires 2 terminals to work in conjunction with each other :

1. The 1st Terminal will start a netcat listener on a chosen port number &
2. The 2nd Terminal will connect to it using **./suconnect** <Port Number>command.

Once setup, in the 1st Terminal, enter bandit**20’s password. The password will be send through netcat for `./suconnect**to read. Once./suconnect` has received & validate the password entered, it will reply with bandit**21**’s password.

Alternatively, we can both start a netcat listener & enter password at the same time. (Continue reading from Step 4 to Step 6).

[# Step 4]: Since the port number chosen, MUST NOT be already in use by another application or service. Thus, run **nmap** localhost to detect the open ports on the host localhost. Here, “own network daemon” meant localhost.

bandit20@bandit:~$ nmap localhost

Starting Nmap 7.40 ( https://nmap.org ) at 2020-06-27 12:21 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00025s latency).
Not shown: 997 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
113/tcp   open  ident
30000/tcp open  ndmps

Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

Choose any port number not listed in the output. In this case, I will pick 6000 to be the port number.

[# Step 5]: To start a netcat listener, run **nc -lp** 6000 command.

Recall, netcat is a simple unix utility which reads and writes data across network connections, using TCP or UDP protocol.

┌──────────────────┬───────────────────────────────────────────┐
│      Option      │                Explanation                │
├──────────────────┼───────────────────────────────────────────┤
│ -l               │ To specify that nc should listen for an   │
│                  │ incoming connection rather than initiate  │
│                  │ a connection to a remote host.            │
│                  │                                           │
│ -p <Port Number> │ Specifies the Port Number nc should use.  │
└──────────────────┴───────────────────────────────────────────┘

[# Step 6]: Once netcat begin to listen on port 6000, open a 2nd Terminal. Connect and login to the same account as done in *[# Step 1]*. Next, run `./suconnect** 6000to connect to port6000` on localhost using TCP.

[# Step 7]: Back to the 1st Terminal, enter bandit**20’s password. If password is correctly entered, it will display `bandit21`**’s password.

Alternatively, instead of starting the netcat listener and entering password separately, in [#Step 5] we can do BOTH at the same time using either command:

1. **echo** “GbKksEFF4yrVs6il55v6gwY5aVje5f0j” | nc -lp 6000 2. **cat** /etc/bandit_pass/bandit20 | nc -lp 6000

Afterwards, proceed to [# Step 6].

[# Step 8]: To logout, run exit on both terminal.

Solution

[# Step 1]
>  ~ ssh bandit20@bandit.labs.overthewire.org -p 2220

This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit20@bandit.labs.overthewire.org's password:
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

[# Step 2]
bandit20@bandit:~$ ls -l
total 12
-rwsr-x--- 1 bandit21 bandit20 12088 May  7 20:14 suconnect

[# Step 3]
bandit20@bandit:~$ ./suconnect
Usage: ./suconnect <portnumber>
This program will connect to the given port on localhost using TCP. If it receives the correct password from the other side, the next password is transmitted back.

[# Step 4]
bandit20@bandit:~$ nmap localhost

Starting Nmap 7.40 ( https://nmap.org ) at 2020-06-27 12:21 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00025s latency).
Not shown: 997 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
113/tcp   open  ident
30000/tcp open  ndmps

Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

[Method 1] — Start netcat listener → Enter Password

In 1st Terminal :

[# Step 5]
bandit20@bandit:~$ nc -lp 6000

In 2nd Terminal :

[# Step 6]
>  ~ ssh bandit20@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit20@bandit.labs.overthewire.org's password:
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

bandit20@bandit:~$ ./suconnect 6000

Back to 1st Terminal :

[# Step 7]
bandit20@bandit:~$ nc -lp 6000
GbKksEFF4yrVs6il55v6gwY5aVje5f0j          # Input password here!
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr          # Bandit21 Password

2nd Terminal’s Output :

bandit20@bandit:~$ ./suconnect 6000
Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Password matches, sending next password

[Method 2] — Start netcat listener & Enter Password

In 1st Terminal :

[# Step 5]
bandit20@bandit:~$ echo "GbKksEFF4yrVs6il55v6gwY5aVje5f0j" | nc -lp 6000
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr

# OR

bandit20@bandit:~$ cat /etc/bandit_pass/bandit20 | nc -lp 6000
gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr

In 2nd Terminal :

[# Step 6]
>  ~ ssh bandit20@bandit.labs.overthewire.org -p 2220

This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit20@bandit.labs.overthewire.org's password:
GbKksEFF4yrVs6il55v6gwY5aVje5f0j

bandit20@bandit:~$ ./suconnect 6000
Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Password matches, sending next password

Level 21’s Username & Password

Username : bandit21
Password : gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr

Level 20 Completed !

Resources

https://explainshell.com/
http://www.ee.surrey.ac.uk/Teaching/Unix/unix1.html#:~:text=1.1%20Listing%20files%20and%20directories&text=When%20you%20first%20login%2C%20your,files%20and%20subdirectories%20are%20saved.
https://securitytrails.com/blog/open-ports#:~:text=Ports%20are%20designated%20by%20numbers,be%20assigned%20to%20any%20services.&text=Once%20a%20port%20is%20running,services%20on%20that%20same%20port.

Previously …

[embed][OverTheWire] Bandit Level 19 → 20 To gain access to the next level, you should use the setuid binary in the home directory. Execute it without arguments…medium.com

To Continue …

[embed][OverTheWire] Bandit Level 21 → 22 A program is running automatically at regular intervals from cron, the time–based job scheduler. Look in /etc/cron.d/…medium.com