Bandit
How to start? visit https://overthewire.org/wargames/bandit/bandit0.html
ssh **bandit.labs.overthewire.org -p 2220**
Report on all the levels from Over The Wire’s Bandit documented here
Level 0
Credentials
pass: bandit0Commands
cat readme`NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL`Level 1
Credentials
pass: NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjLCommands
cat ./-`rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi`Level 2
Credentials
pass: rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgziCommands
cat "spaces in this filename"ORcat spaces\ in\ this\ filename`aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG`Level 3
Credentials
pass:aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiGCommands
cd inherels -lacat .hidden`2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe`Level 4
Credentials
pass: 2EW7BBsr6aMMoJ2HjW067dm8EgX26xNeCommands
cd inherecat ./_ORfile ./_cat ./-file07`lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR`Level 5
Credentials
pass: lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqRCommands
cd inherefind -type f -size 1033ccd maybehere07cat .file2`P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU`Level 6
Credentials
pass: P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJUCommands
$ find / -type f -size 33c -group bandit6 -user bandit7 2>&1 | grep -v "Permission denied"cd /var/lib/dpkg/info/bandit7.password`z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S`Level 7
Credentials
pass: z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99SCommands
cat data.txt | grep millionthORfind / -name "data.txt" -exec grep -H 'millionth' {} \; 2>&1 | grep -v "Permission denied"`TESKZC0XvTetK0S9xNwm25STk5iWrBvP`Level 8
Credentials
pass: TESKZC0XvTetK0S9xNwm25STk5iWrBvPCommands
sort data.txt | uniq -c | grep "1 "`EN632PlfYiZbn3PhVK3XOGSlNInNE00t`Level 9
Credentials
pass: EN632PlfYiZbn3PhVK3XOGSlNInNE00tCommands
strings data.txt | grep "^=="`G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s`Level 10
Credentials
pass: G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6sCommands
cat data.txt | base64 -d`6zPeziLdR2RKNdNYFNb6nVCKzphlXHBM`Level 11
Credentials
pass: 6zPeziLdR2RKNdNYFNb6nVCKzphlXHBMCommands
cat data.txt | tr 'A-Za-z' 'N-ZA-Mn-za-m'`JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRv`Level 12
Credentials
pass: JVNBBFSmZwKKOP0XbFXOoW8chDz5yVRvCommands
2 mkdir /tmp/pass 3 mkdir /tmp/pas 4 cp data.txt /tmp/pas 5 cd /tmp/pas 6 ls 7 file data.txt 8 cat data.txt 9 xxd -r data.txt data.out
10 ls11 rm data.out12 xxd -r data.txt new13 ls14 file new15 mv new new.gz16 gzip -d new.gz17 ls18 file new19 bzip2 -d new20 mv new new.bzip221 ls22 bzip2 -d new.out23 mv new.out new.bzip224 ls25 bzip2 -d new.bzip226 bzip2 -d new27 file new.bzip228 mv new.bzip2 new.gzip29 gzip -d new.gzip30 mv new.gzip new.gz31 gzip -d new.gz32 ls33 file new34 ls35 tar -xf new36 ls37 file data5.bin38 tar -xf data5.bin39 ls40 file data6.bin41 bzip2 -d data6.bin42 ls43 file data6.bin.out44 tar -xf data6.bin.out45 ls46 file data8.bin47 gzip -d data8.bin48 mv data8.bin newData.gz49 gzip -d newData.gz50 ls51 file newData52 cat newData`wbWdlBxEir4CaE8LaPhauuOo6pwRmrDw`Level 13
Credentials
pass: wbWdlBxEir4CaE8LaPhauuOo6pwRmrDwCommands
ssh -i sshkey.private [email protected] -p 2220Level 14
Credentials
pass: `either download shh key file or use it directly from level 13`Commands
cat /etc/bandit_pass/bandit14 | nc localhost 30000`jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt`Level 15
Credentials
pass: jN2kgmIXJ6fShzhT2avhotn4Zcka6tnCommands
cat /etc/bandit_pass/bandit15 | openssl s_client -connect localhost:30001 -quiet`JQttfApK4SeyHwDlI9SXGR50qclOAil1`Level 16
Credentials
pass:JQttfApK4SeyHwDlI9SXGR50qclOAil1Commands
cat /etc/bandit_pass/bandit16 | openssl s_client -connect localhost:31790 -quiet
- copy the key cd /tmp nano sshkey \* paste chmod 600 sshkeyLevel 17
Credentials
pass: sshkeyCommands
diff passwords.old passwords.new`hga5tuuCLF6fFzUpnagiMN8ssu9LFrdg`Level 18
Credentials
pass: hga5tuuCLF6fFzUpnagiMN8ssu9LFrdgCommands
❯ ssh [email protected] -p 2220 "cat readme"`awhqfNnAbc1naukrpqDYcF95h7HoMTrC`Level 19
Credentials
pass: awhqfNnAbc1naukrpqDYcF95h7HoMTrCCommands
./bandit20-do cat /etc/bandit_pass/bandit20`VxCazJaVykI6W36BkBU0mJTCM8rR95XT`Level 20
Credentials
pass:VxCazJaVykI6W36BkBU0mJTCM8rR95XTCommands
nc -lp 31337 < /etc/bandit_pass/bandit20
- another terminal ./suconnect 31337 `NvEJF7oVjkddltPSrdKEFOllh9V1IBcq`Level 21
Credentials
pass:NvEJF7oVjkddltPSrdKEFOllh9V1IBcqCommands
1 cat /etc/cron.d/cronjob_bandit22 2 cat /usr/bin/cronjob_bandit22.sh 3 cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
`WdDozAdTM2z9DiFEQ2mGlwngMfj4EZff`Level 22
Credentials
pass:WdDozAdTM2z9DiFEQ2mGlwngMfj4EZffCommands
cat /etc/cron.d/cronjob_bandit23 cat /usr/bin/cronjob_bandit23.sh echo "I am user bandit23" | md5sum cat /tmp/8ca319486bfbbc3663ea0fbe81326349
`QYw0Y2aiA672PsMmh9puTQuhoz8SyR2G`Level 23
Credentials
pass:QYw0Y2aiA672PsMmh9puTQuhoz8SyR2GCommands
cat /etc/cron.d/cronjob_bandit24cat /usr/bin/cronjob_bandit24.shcd /var/spool/bandit24/foo/vi 1.sh#!/bin/bashcat /etc/bandit_pass/bandit24 > /tmp/test/password
- creating script file chmod 777 script.sh chmod 777 /tmp/test cd tmp/test cat password `VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar`Level 24
Credentials
pass:VAfGXJ1PBSsPSnvsjI8p759leLZ9GGarCommands
nc localhost 30002cd /tmp/testvi scr.sh#!/bin/shfor i in {0000..9999}doecho VAfGXJ1PBSsPSnvsjI8p759leLZ9GGar $i >> possibilities.txtdonechmod 777 scr.sh./scr.shcat possibilities.txt | nc localhost 30002 > result.txt
- can take time sort result.txt | grep -v "Wrong!" `p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8d`Level 25
Credentials
pass: p7TaowMYrmu23Ol8hiZh9UvD0O9hpx8dCommands
cat bandit26.sshkeycp bandit26.sshkey /tmp/testssh -i bandit26.sshkey bandit26@localhost
- when More(when terminal size small) v- go to normal :set shell=/bin/bash :e /etc/bandit_pass/bandit26 `c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1`Level 26
Credentials
pass: c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1Commands
./bandit27-do cat /etc/bandit_pass/bandit27\*we can from the level 25`YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS`Level 27
Credentials
pass: YnQpBuifNMas1hcUFk70ZmqkhUU2EuaSCommands
git clone ssh://bandit27-git@localhost:2220/home/bandit27-git/repocd repocat README.md`AVanL161y9rsbcJIsFHuw35rjaOM19nR`Level 28
Credentials
pass: AVanL161y9rsbcJIsFHuw35rjaOM19nRCommands
git clone ssh://bandit28-git@localhost:2220/home/bandit27-git/repocd repocat README.mdgit loggit checkout f08b9cc63fa1a4602fb065257633c2dae6e5651bcat README.md`tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8S`Level 29
Credentials
pass: tQKvmcwNYcFS6vmPHIUSI3ShmsrQZK8SCommands
git clone ssh://bandit29-git@localhost:2220/home/bandit27-git/repocd repogit checkout devcat README.md`xbhV3HpNGlTIdnjUrdAlPzc2L6y9EOnS`Level 30
Credentials
pass:Commands
git clone ssh://bandit30-git@localhost:2220/home/bandit27-git/repocd repo/git taggit show secret`OoffzGDlzhAlerFJ2cAiz1D41JW1Mhmt`Level 31
Credentials
pass: OoffzGDlzhAlerFJ2cAiz1D41JW1MhmtCommands
git clone ssh://bandit31-git@localhost:2220/home/bandit27-git/repocd repolscat README.mdvi key.txtMay I come in?git add -f key.txtgit commit -m "done"git push origin master`rmCBvG56y58BXzv98yZGdO7ATVL5dW8y`Level 32
Credentials
pass: rmCBvG56y58BXzv98yZGdO7ATVL5dW8yCommands
$0vim:r /etc/bandit_pass/bandit33`odHo63fHiFqcWWJG9rLiLDtPm45KzUKy`Level 33
Credentials
pass: odHo63fHiFqcWWJG9rLiLDtPm45KzUKyCommands
lscat README.txt