[OverTheWire] Bandit Level 31 → 32

https://overthewire.org/wargames/bandit/bandit32.html

Goal

There is a git repository at *ssh://bandit31-git@localhost/home/bandit31-git/repo. The password for the user `bandit31-git* is the same as for the userbandit31`.

Clone the repository and find the password for the next level.

Possible commands to solve this level

*git*

┌─────────┬────────────────────────────────────────────────┐
│ Command │                  Explanation                   │
├─────────┼────────────────────────────────────────────────┤
│ git     │ Git is a version control system to keep track  │
│         │ of changes to files and projects over time     │
└─────────┴────────────────────────────────────────────────┘

Write Up

Information

Host Name : bandit.labs.overthewire.org
Username : bandit31
Password : 47e603bb428404d265f59c42920d81e5
Port Number : 2220

To find the password for Level 32

[# Step 1]: Connect and login to the account with the username & password stated above.

[# Step 2]: Similar to previous level, the initial part explained in [# Step 2] to [# Step 4] are identical.

As mentioned in the description, to obtain bandit32‘s password, we are require to “clone the repository”. In other words, we have to create a copy of the repository.

Since a WRITE permission is needed to create a copy of the repository. Hence, we can’t clone it in the home directory (~/) with only a READ permission. Therefore, we have to create a temporary folder in /tmp directory FIRST, before cloning the repository. In this case, I will named my temporary folder as myBandit31:

bandit31@bandit:~$ mkdir /tmp/myBandit31
bandit31@bandit:~$ cd /tmp/myBandit31
bandit31@bandit:/tmp/myBandit31$

[# Step 3]: Next, in myBandit31 folder, we will clone the repository by using the **git clone command: `git clone** ssh://bandit31-git@localhost/home/bandit31-git/repoand enterbandit31`‘s password when prompt. The git will then create a working copy of the cloned repository.

As mentioned in the previous level, the command git clone will clone a repository into a new directory.

bandit31@bandit:/tmp/myBandit31$ git clone ssh://bandit31-git@localhost/home/bandit31-git/repo
Cloning into 'repo'...
Could not create directory '/home/bandit31/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit31/.ssh/known_hosts).
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit31-git@localhost's password: 47e603bb428404d265f59c42920d81e5
remote: Counting objects: 4, done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 4 (delta 0), reused 0 (delta 0)
Receiving objects: 100% (4/4), done.

[# Step 4]: After cloning, executing ls will display a folder named repo. After changing directory to repo, running ls again will display a file named README.md. Reading the file, we are informed that we have to push a file, named key.txt to the remote repository with the following contents: “May I come in?”.

bandit31@bandit:/tmp/myBandit31$ ls
repo
bandit31@bandit:/tmp/myBandit31$ cd repo/
bandit31@bandit:/tmp/myBandit31/repo$ ls
README.md
bandit31@bandit:/tmp/myBandit31/repo$ cat README.md
This time your task is to push a file to the remote repository.

Details:
    File name: key.txt
    Content: 'May I come in?'
    Branch: master

[# Step 5]: Following the instructions in README.md, run:

1. **echo** “May I come in?” **> **key.txt to redirect the output (message) to a file named key.txt.
2. **cat** key.txt to verify the contents in the newly created key.txt.

[# Step 6]: Finally, we run:

1. **git add** -f key.txt to add key.txt & ignored files to the repository. Here, the -f / -force option is added to allow adding otherwise ignored files. In our case, it is .gitignore files.

• (Optional: Try without having -force option: git add key.txt)*

2. **git commit** -m key.txt to commit
3. **git push** origin master to push key.txt to the **master** branch. Enter bandit31‘s password when prompt.

Once above commands are run, the password for bandit32 is revealed.

bandit31@bandit:/tmp/myBandit31/repo$ git add -f key.txt
bandit31@bandit:/tmp/myBandit31/repo$ git commit -m key.txt
[master 3989c35] key.txt
 1 file changed, 1 insertion(+)
 create mode 100644 key.txt
bandit31@bandit:/tmp/myBandit31/repo$ git push origin master
Could not create directory '/home/bandit31/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit31/.ssh/known_hosts).
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit31-git@localhost's password: 47e603bb428404d265f59c42920d81e5
Counting objects: 3, done.
Delta compression using up to 2 threads.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 319 bytes | 0 bytes/s, done.
Total 3 (delta 0), reused 0 (delta 0)
remote: ### Attempting to validate files... ####
remote:
remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.
remote:
remote: Well done! Here is the password for the next level:
remote: 56a9bf19c63d650ce78e6ec0354ee45e
remote:
remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.
remote:
To ssh://localhost/home/bandit31-git/repo
 ! [remote rejected] master -> master (pre-receive hook declined)
error: failed to push some refs to 'ssh://bandit31-git@localhost/home/bandit31-git/repo'

[# Step 7]: To logout:

1. First, perform rm -rf /tmp/myBandit31 to removed the temporary file created.
2. Finally, execute exit to quit the program.

Solution

[# Step 1]
>  ~ ssh bandit31@bandit.labs.overthewire.org -p 2220

This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit31@bandit.labs.overthewire.org's password:
47e603bb428404d265f59c42920d81e5

[# Step 2]
bandit31@bandit:~$ mkdir /tmp/myBandit31
bandit31@bandit:~$ cd /tmp/myBandit31

[# Step 3]
bandit31@bandit:/tmp/myBandit31$ git clone ssh://bandit31-git@localhost/home/bandit31-git/repo
Cloning into 'repo'...
Could not create directory '/home/bandit31/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit31/.ssh/known_hosts).
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit31-git@localhost's password: 47e603bb428404d265f59c42920d81e5
remote: Counting objects: 4, done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 4 (delta 0), reused 0 (delta 0)
Receiving objects: 100% (4/4), done.

[# Step 4]
bandit31@bandit:/tmp/myBandit31$ ls
repo
bandit31@bandit:/tmp/myBandit31$ cd repo/
bandit31@bandit:/tmp/myBandit31/repo$ ls
README.md
bandit31@bandit:/tmp/myBandit31/repo$ cat README.md
This time your task is to push a file to the remote repository.

Details:
    File name: key.txt
    Content: 'May I come in?'
    Branch: master

[# Step 5]
bandit31@bandit:/tmp/myBandit31/repo$ echo "May I come in?" > key.txt
bandit31@bandit:/tmp/myBandit31/repo$ cat key.txt
May I come in?

[# Step 6]
bandit31@bandit:/tmp/myBandit31/repo$ git add -f key.txt
bandit31@bandit:/tmp/myBandit31/repo$ git commit -m key.txt
[master 3989c35] key.txt
 1 file changed, 1 insertion(+)
 create mode 100644 key.txt
bandit31@bandit:/tmp/myBandit31/repo$ git push origin master
Could not create directory '/home/bandit31/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit31/.ssh/known_hosts).
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit31-git@localhost's password: 47e603bb428404d265f59c42920d81e5
Counting objects: 3, done.
Delta compression using up to 2 threads.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 319 bytes | 0 bytes/s, done.
Total 3 (delta 0), reused 0 (delta 0)
remote: ### Attempting to validate files... ####
remote:
remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.
remote:
remote: Well done! Here is the password for the next level:
remote: 56a9bf19c63d650ce78e6ec0354ee45e
remote:
remote: .oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.oOo.
remote:
To ssh://localhost/home/bandit31-git/repo
 ! [remote rejected] master -> master (pre-receive hook declined)
error: failed to push some refs to 'ssh://bandit31-git@localhost/home/bandit31-git/repo'

[# Step 7]
bandit31@bandit:/tmp/myBandit31/repo$ rm -rf /tmp/myBandit31
bandit31@bandit:/tmp/myBandit31/repo$ exit
logout
Connection to bandit.labs.overthewire.org closed.

Level 32’s Username & Password

Username : bandit32
Password : 56a9bf19c63d650ce78e6ec0354ee45e

Level 31 Completed !

Resources

https://explainshell.com/
https://git-scm.com/docs/git-add

Previously …

[embed][OverTheWire] Bandit Level 30 → 31 There is a git repository at ssh://bandit30-git@localhost/home/bandit30-git/repo. The password for the user…medium.com

To Continue …