What is it? @.@

Here is the place where I record some tactics about wargame, systems, and other security issues.

2014-01-23

OverTheWire - Bandit - Level 21 to Level 22

Description:

Level Goal
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.
Commands you may need to solve this level
cron, crontab, crontab(5) (use "man 5 crontab" to access this)
Solution:
  1. [Comment] Using SSH to connect the server
  2. sp@simple-plan:~|=> ssh bandit21@bandit.labs.overthewire.org
    ...
    bandit21@bandit.labs.overthewire.org's password: gE269g2h3mw3pwgrj0Ha9Uoqen1c9DGr
  3. [Comment] Using cd command to change the shell working directory
  4. bandit21@melinda:~$ cd /etc/cron.d
  5. [Comment] Using ls command to list directory contents
  6. bandit21@melinda:/etc/cron.d$ ls
    boobiesbot-checkcronjob_bandit24manpage3_resetpw_jobnatas26_cleanupsemtex0-ppcsemtex6vortex0
    cron-apteloi0natas-session-toucherphp5semtex10semtex8vortex20
    cronjob_bandit22eloi1natas-statssemtex0-32semtex12semtex9vulnbot0-check
    cronjob_bandit23hintbot-checknatas25_cleanupsemtex0-64semtex5sysstatvulnbot1-check
  7. [Comment] Using cat command to output file's contents
  8. bandit21@melinda:/etc/cron.d$ cat cronjob_bandit22
    * * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
  9. [Comment] Using cat command to check the script content
  10. bandit21@melinda:/etc/cron.d$ cat /usr/bin/cronjob_bandit22.sh
    #!/bin/bash
    chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
    cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
  11. [Comment] Using cat command to fetch out the password for next level
  12. bandit21@melinda:/etc/cron.d$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
    Yk7owGAcWjwMVRwrTesJEwB7WVOiILLI
  13. [Comment] Using exit command to disconnect connection to server
  14. bandit21@melinda:/etc/cron.d$ exit
    logout
    Connection to bandit.labs.overthewire.org closed.
  15. [Comment] It's done! Saving the password for next level.
Reference:
sshhttp://linuxcommand.org/man_pages/ssh1.html
lshttp://linuxcommand.org/man_pages/ls1.html
cathttp://linuxcommand.org/man_pages/cat1.html
exithttp://linuxcommand.org/man_pages/exit1.html
cdhttp://linuxcommand.org/lc3_man_pages/cdh.html
findhttp://linuxcommand.org/man_pages/find1.html
grephttp://linuxcommand.org/lc3_man_pages/grep1.html
sorthttp://linuxcommand.org/lc3_man_pages/sort1.html
uniqhttp://linuxcommand.org/man_pages/uniq1.html
stringshttp://linuxcommand.org/man_pages/strings1.html
base64http://linux.die.net/man/1/base64
trhttp://linuxcommand.org/man_pages/tr1.html
aliashttp://linuxcommand.org/man_pages/alias1.html
mkdirhttp://linuxcommand.org/man_pages/mkdir1.html
cphttp://linuxcommand.org/man_pages/cp1.html
xxdhttp://linuxcommand.org/man_pages/xxd1.html
filehttp://linuxcommand.org/man_pages/file1.html
mvhttp://linuxcommand.org/man_pages/mv1.html
gziphttp://linuxcommand.org/man_pages/gzip1.html
bzip2http://linuxcommand.org/man_pages/bzip21.html
tarhttp://linuxcommand.org/man_pages/tar1.html
echohttp://linuxcommand.org/man_pages/echo1.html
nchttp://linuxcommand.org/man_pages/nc1.html
opensslhttp://linuxcommand.org/man_pages/openssl1.html
diffhttp://linuxcommand.org/man_pages/diff1.html
envhttp://linuxcommand.org/man_pages/env1.html
cronhttp://linuxcommand.org/man_pages/cron8.html
crontabhttp://linuxcommand.org/man_pages/crontab1.html

No comments:

Post a Comment