Bandit WarGame Level 16 -> Level 17

팥들었슈_ 2023. 11. 17. 10:58

2023. 11. 17. 10:58

Bandit Level 16 → Level 17

Level Goal

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

Port scanner on Wikipedia

다음 레벨로가기위해서 현재레벨의 비밀번호를 제출해라 localhost의 31000 - 32000 포트중에서 포트는 1개 이상이다.

일단 31000 - 32000포트 중 리슨중인 포트를 찾아보자.

bandit16@bandit:~$ nc -vz localhost 31000-32000 2>&1 | grep "succeeded!"
Connection to localhost (127.0.0.1) 31046 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31518 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31691 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31790 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31960 port [tcp/*] succeeded!

nc(netcat): 호스트의 포트로 접속

-v: 추가 정보를 볼 수 있다. 옵션을 주지 않으면 아무것도 보이지 않는다.
-z: 기본적으로 nc는 포트가 리슨이라면 접속 후 대기한다. z옵션은 접속 하지 않고 검색만한다.
31000-32000: 포트접속 범위

접속가능한 포트는 5개이다.

bandit16@bandit:~$ openssl s_client -connect localhost:31790
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = localhost
verify error:num=10:certificate has expired
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
depth=0 CN = localhost
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = localhost
   i:CN = localhost
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Nov 14 21:27:41 2023 GMT; NotAfter: Nov 14 21:28:41 2023 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDCzCCAfOgAwIBAgIEPPSSSjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMjMxMTE0MjEyNzQxWhcNMjMxMTE0MjEyODQxWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB
IlejBXoR34ClW2gpf9BwT9mBZj7MlPBqzA1wqoVj0aAaiIjVkuaqFM6bDWkebjql
z1R0bZfMPrlG2rcSB46R0mTZEc+dS1ifSw8lXzRB+YWbZcTU4O8xaDvnQcu6WcnV
tz6mnB7YwpFeZCZx1cEpcwYZAtqyhNz/4vjtvLc5tj7mk5oZRpuibEB/HJe+YIsY
AC2LBmIT5Ld6s5kOyIHhrlQZaIHX0j2q4SZusAUaVsvqF5lYJYqZRESHHxyV3EOw
AprzDR0COBlC9gX8es0j4/m2Kdt03xAcGD8i4Mk/Bj5gkkZyHm97h8hE8r2I1O39
/qmvYzubUFrfxKE/GGhZAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBL
BglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4g
U2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4IBAQCG
8jn78KslFph6DMwit8hQ1TB1bUtF6TfHojgjOGIYgKz2IECcDKyvBXqWG5XYM9B2
FR7yfQRTtVKraPipZg4eyXfFWeIEKbv7by868IlrjuseoprB3tGs6QdMPBkHyti8
4RUk9/RGNnzYJZ1/98FLqZz/Nn4PDq4w3CCk7tLH4lVYMEpbYDMp/FNS8QUZJHDr
xTxMD+q67q4YcnsW6zhYEYfDsaNlFaJ5jCIrgsEeZZZVsDCDUKEmDGKnpTba9oOo
BdhzuIB3Rfu2HKImaHx3BU7S3vSdvMlvCgODUKp745dOegSRM5O6KDql+Bv/EF5+
R4TyvPpslc6E6C4zgMbm
-----END CERTIFICATE-----
subject=CN = localhost
issuer=CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1339 bytes and written 373 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 50FFF1CE36BCE3573679CBB36DB4396B87650EA334A2399DABC686E585277B4F
    Session-ID-ctx:
    Resumption PSK: F67614789291F6260A5F666EC8FC35D3414BADC9E6EEB7CA4DF3C7B9D77D8129193263ED1E8072196AB0CE56C27EAEA8
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - eb 9c 29 32 fd 07 13 85-99 26 1e 7a df ec 2d 88   ..)2.....&.z..-.
    0020 - 3f 10 0c 0d 8f 67 99 02-99 2d 62 67 57 3f 1f fa   ?....g...-bgW?..
    0030 - 02 15 a1 25 c2 d9 7b 8e-fd 7c 01 72 72 45 cb 63   ...%..{..|.rrE.c
    0040 - b5 06 03 e7 24 aa 49 f2-8e 9c 03 0f 8c ff 99 40   ....$.I........@
    0050 - 97 04 af 36 5a 6f b3 01-fc 30 76 c1 73 71 59 cf   ...6Zo...0v.sqY.
    0060 - f9 f7 26 14 f9 ad 68 5b-90 c8 51 0b d0 02 95 25   ..&...h[..Q....%
    0070 - 6c 8c e6 ad b0 d0 5d a4-07 47 97 66 46 88 2c 7e   l.....]..G.fF.,~
    0080 - 8c 61 79 17 56 e1 aa 80-2a 33 c2 9f 21 71 51 b2   .ay.V...*3..!qQ.
    0090 - 16 f6 a5 29 98 7b b3 e7-73 f0 df 88 f2 56 df fa   ...).{..s....V..
    00a0 - 94 10 e0 da 3c 41 65 1f-28 37 b8 34 0a 13 96 e3   ....<Ae.(7.4....
    00b0 - 49 16 14 0b 31 aa bc f7-d8 9a 83 05 dc 19 e7 f0   I...1...........
    00c0 - 74 07 e4 35 6c 65 33 de-6d 0a 2c 07 82 e6 4d e2   t..5le3.m.,...M.

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: F706A8D5FB8A59F379D588528A382372E116D92D7D0DA42D6533B4F63D7667ED
    Session-ID-ctx:
    Resumption PSK: 222B5500FBE8111E0343E8348B2BDB0E9BFDDBADC7CE1766E7D780B4FE09447BA63333F3E2A44ABB96E03A24E867BB8A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - 00 b7 e6 63 5f 88 45 78-6c 6c 18 a7 48 61 df 04   ...c_.Exll..Ha..
    0020 - cd 3c 15 e3 39 3d ed fb-35 a4 86 6e 78 d5 58 3e   .<..9=..5..nx.X>
    0030 - 72 b7 9c f1 45 b5 39 40-a9 e1 cc b4 89 73 70 6f   r...E.9@.....spo
    0040 - b0 b2 99 66 0a 6c fb d4-a7 e8 3d 29 31 16 30 3c   ...f.l....=)1.0<
    0050 - 02 1b e0 9c f1 9e 8d ae-9b 82 fc 29 a8 09 1f ad   ...........)....
    0060 - 7b b8 e3 b7 22 cc f2 ff-61 8e 0a 95 ec 0b 49 70   {..."...a.....Ip
    0070 - 9d d7 67 44 73 9c 7f c3-13 14 a8 d8 e3 4c 45 ff   ..gDs........LE.
    0080 - 42 b0 5f 9d 1a 9a f4 06-fc ba 3d 8e 9d 84 ce f8   B._.......=.....
    0090 - ca 89 bf 00 e7 a7 b2 d3-de 7a e0 e6 d9 08 a5 01   .........z......
    00a0 - 2a 89 be 69 7c 5d 56 d2-49 28 5e ea f7 55 f1 52   *..i|]V.I(^..U.R
    00b0 - 16 5e 33 c8 e1 a5 82 81-71 4c 2b b5 ba 0b 69 45   .^3.....qL+...iE
    00c0 - d7 da 8b a3 65 51 4a 66-af 5d f2 00 33 de 36 7b   ....eQJf.]..3.6{

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
JQttfApK4SeyHwDlI9SXGR50qclOAil1
Correct!
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

closed

/etc/tmp/patrache25 디렉토리 생성후

key.private 파일을 생성하여 begin부터 end 까지 붙여넣기 후 chmod 600 key.private 한다.

bandit16@bandit:/tmp/patrache25$ ll
total 408
drwxrwxr-x    2 bandit16 bandit16   4096 Nov 17 01:41 ./
drwxrwx-wt 2115 root     root     405504 Nov 17 01:43 ../
-rw-------    1 bandit16 bandit16   1675 Nov 17 01:41 key.private
bandit16@bandit:/tmp/patrache25$ cat key.private
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

이제 key로 bandit17로 접속하면 끝

bandit16@bandit:/tmp/patrache25$ ssh -i key.private bandit17@localhost -p2220

bandit17@bandit:~$ cat /etc/bandit_pass/bandit17
VwOSWtCA7lRKkTfbr2IDh6awj9RNZM5e

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 15 -> Level 16(openssl s_client) (0)	2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet) (0)	2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i) (0)	2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d) (0)	2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환) (1)	2023.11.15

팥들었슈