Overthewire – Bandit 0 -> Bandit 5 (Part 1)
# Information:
CTF Name: Overthewire
CTF Challenge: Bandit
Challenge Category: Linux
Challenge Points: Easy – for absolute beginners
# Used Tools:
- SSH (to access the challenge)
- Linux Terminal (that is what we have)
# Challenges:
Bandit 0 -> Bandit 1
Main URL: Bandit 0 and Bandit 0 -> Bandit 1
The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.
The password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.
# Writeup
Step 1
This is a fairly easy challenge. To solve this one simply has to read a little the ssh manual.
We know that the user is bandit0, the address is bandit.labs.overthewire.org and that the port is 2220.
Once we combine this into an ssh command we get:
mregra on Cyber $ ssh [email protected] -p 2220
After pressing enter, we are asked if we want to continue connecting, after typing yes we have to put a password, and in this case, by reading the challenge description we know that it is bandit0.
And we are in!
Step 2
To get the flag, we have to simply see the contents of the file readme by running the command:
bandit0@bandit:~$ cat readme
And we get the flag:
Bandit 1 -> Bandit 2
Main URL: Bandit 1 -> Bandit 2
The password for the next level is stored in a file called – located in the home directory.
# Writeup
Step 1
First we have to use the same command as in the previous challenge, but this time the user is bandit1 and the password is the flag of the previous challenge. The ssh command is:
mregra on Cyber $ ssh [email protected] -p 2220
After putting the flag from the previous challenge as the password we are in!
Step 2
To get the flag, we have to simply see the contents of the file –
To see the contents of – we cannot simply run cat – this will result in a endless wait, and the command will not return anything.
To see the contents we have to indicate the path, in this case:
bandit1@bandit:~$ cat ./-
Meaning that we want to cat the file with the name – in the present directory.
And we get the flag:
Bandit 2 -> Bandit 3
Main URL: Bandit 2 -> Bandit 3
The password for the next level is stored in a file called – located in The password for the next level is stored in a file called spaces in this filename located in the home directory
# Writeup
Step 1
As in the previous one we have to use the same command as in the previous challenge, but this time the user is bandit2 and the password is the flag of the previous challenge. The ssh command is:
mregra on Cyber $ ssh [email protected] -p 2220
After putting the flag from the previous challenge as the password we are in!
Step 2
To get the flag, we have to simply see the contents of the file “spaces in this filename”
To see the contents of spaces in this filename we have to be careful with the spaces. But this is also simple, one simply has to use the back slash every time there is a space.
To see the contents we have to indicate the path, in this case:
bandit2@bandit:~$ cat spaces\ in\ this\ filename
And we get the flag:
Bandit 3 -> Bandit 4
Main URL: Bandit 3 -> Bandit 4
The password for the next level is stored in a hidden file in the inhere directory.
# Writeup
Step 1
As in the previous one we have to use the same command as in the previous challenge, but this time the user is bandit3 and the password is the flag of the previous challenge. The ssh command is:
mregra on Cyber $ ssh [email protected] -p 2220
After putting the flag from the previous challenge as the password we are in!
Step 2
To get the flag, we have to simply see the contents of the hidden file in the folder inhere.
To be able to find hidden files using the Linux terminal we have to use a flag of the command ls, in particular the -a flag, which, according to the ls manual:
bandit3@bandit:~$ man ls
-a, -all
do not ignore entries starting with .
Knowing this, what we have to do is simply to go inside the inhere forlder, by usind the cd command like such:
bandit3@bandit:~$ cd inhere
And once inside the inhere directory we have to list all files, without ignoring the ones that start with . which in Linux are the hidden files.
bandit3@bandit:~/inhere$ ls -a
And we are presented with: . .. .hidden
The first . is the current directory, the two points, .. is the previous directory and the .hidden is the file we want!!
Now to see the contents you know the process:
bandit3@bandit:~/inhere$ cat .hidden
And we get the flag:
Bandit 4 -> Bandit 5
Main URL: Bandit 4 -> Bandit 5
The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the “reset” command.
# Writeup
Step 1
As in the previous one we have to use the same command as in the previous challenge, but this time the user is bandit4 and the password is the flag of the previous challenge. The ssh command is:
mregra on Cyber $ ssh [email protected] -p 2220
After putting the flag from the previous challenge as the password we are in!
Step 2
In this one we have to find the file that is human readable, so ASCII, or something like that.
After entering the machine we can see the home directory contents by using the ls command, we are presented with just one folder, inhere, after moving inside it, by using cd inhere, we can see the inhere directory contents once again with ls.
This time, we get the following:
bandit4@bandit:~/inhere$ ls
-file00 -file01 -file02 -file03 -file04 -file05 -file06 -file07 -file08 -file09
We can go one by one but it takes time! We can, instead, leverage the linux terminal tools that we have at our disposal, in particular the file command, that, according to its manual:
NAME
file — determine file typeWhat we can do is to simply see the file type for all the files inside the inhere directory by using the command:
bandit4@bandit:~/inhere$ file ./*
./-file00: data
./-file01: data
./-file02: data
./-file03: data
./-file04: data
./-file05: data
./-file06: data
./-file07: ASCII text
./-file08: data
./-file09: dataSo it seems that the file ./-file07 has the flag because it is the only one with ASCII text, which is human readable. Lets cat its contents to see!
bandit4@bandit:~/inhere$ cat ./-file07And we get the flag:
Thank you very much for reading!
Cheers,
MRegra
2 Replies to “Overthewire – Bandit 0 -> Bandit 5 (Part 1)”