Bandit Level 16 → Level 17

Level Goal

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

다음 레벨로가기위해서 현재레벨의 비밀번호를 제출해라 localhost의 31000 - 32000 포트중에서 포트는 1개 이상이다.

 

일단 31000 - 32000포트 중 리슨중인 포트를 찾아보자.

bandit16@bandit:~$ nc -vz localhost 31000-32000 2>&1 | grep "succeeded!"
Connection to localhost (127.0.0.1) 31046 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31518 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31691 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31790 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31960 port [tcp/*] succeeded!

nc(netcat): 호스트의 포트로 접속

  • -v: 추가 정보를 볼 수 있다. 옵션을 주지 않으면 아무것도 보이지 않는다.
  • -z: 기본적으로 nc는 포트가 리슨이라면 접속 후 대기한다. z옵션은 접속 하지 않고 검색만한다.
  • 31000-32000: 포트접속 범위

접속가능한 포트는 5개이다.

 

bandit16@bandit:~$ openssl s_client -connect localhost:31790
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = localhost
verify error:num=10:certificate has expired
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
depth=0 CN = localhost
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = localhost
   i:CN = localhost
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Nov 14 21:27:41 2023 GMT; NotAfter: Nov 14 21:28:41 2023 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDCzCCAfOgAwIBAgIEPPSSSjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMjMxMTE0MjEyNzQxWhcNMjMxMTE0MjEyODQxWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB
IlejBXoR34ClW2gpf9BwT9mBZj7MlPBqzA1wqoVj0aAaiIjVkuaqFM6bDWkebjql
z1R0bZfMPrlG2rcSB46R0mTZEc+dS1ifSw8lXzRB+YWbZcTU4O8xaDvnQcu6WcnV
tz6mnB7YwpFeZCZx1cEpcwYZAtqyhNz/4vjtvLc5tj7mk5oZRpuibEB/HJe+YIsY
AC2LBmIT5Ld6s5kOyIHhrlQZaIHX0j2q4SZusAUaVsvqF5lYJYqZRESHHxyV3EOw
AprzDR0COBlC9gX8es0j4/m2Kdt03xAcGD8i4Mk/Bj5gkkZyHm97h8hE8r2I1O39
/qmvYzubUFrfxKE/GGhZAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBL
BglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4g
U2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4IBAQCG
8jn78KslFph6DMwit8hQ1TB1bUtF6TfHojgjOGIYgKz2IECcDKyvBXqWG5XYM9B2
FR7yfQRTtVKraPipZg4eyXfFWeIEKbv7by868IlrjuseoprB3tGs6QdMPBkHyti8
4RUk9/RGNnzYJZ1/98FLqZz/Nn4PDq4w3CCk7tLH4lVYMEpbYDMp/FNS8QUZJHDr
xTxMD+q67q4YcnsW6zhYEYfDsaNlFaJ5jCIrgsEeZZZVsDCDUKEmDGKnpTba9oOo
BdhzuIB3Rfu2HKImaHx3BU7S3vSdvMlvCgODUKp745dOegSRM5O6KDql+Bv/EF5+
R4TyvPpslc6E6C4zgMbm
-----END CERTIFICATE-----
subject=CN = localhost
issuer=CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1339 bytes and written 373 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 50FFF1CE36BCE3573679CBB36DB4396B87650EA334A2399DABC686E585277B4F
    Session-ID-ctx:
    Resumption PSK: F67614789291F6260A5F666EC8FC35D3414BADC9E6EEB7CA4DF3C7B9D77D8129193263ED1E8072196AB0CE56C27EAEA8
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - eb 9c 29 32 fd 07 13 85-99 26 1e 7a df ec 2d 88   ..)2.....&.z..-.
    0020 - 3f 10 0c 0d 8f 67 99 02-99 2d 62 67 57 3f 1f fa   ?....g...-bgW?..
    0030 - 02 15 a1 25 c2 d9 7b 8e-fd 7c 01 72 72 45 cb 63   ...%..{..|.rrE.c
    0040 - b5 06 03 e7 24 aa 49 f2-8e 9c 03 0f 8c ff 99 40   ....$.I........@
    0050 - 97 04 af 36 5a 6f b3 01-fc 30 76 c1 73 71 59 cf   ...6Zo...0v.sqY.
    0060 - f9 f7 26 14 f9 ad 68 5b-90 c8 51 0b d0 02 95 25   ..&...h[..Q....%
    0070 - 6c 8c e6 ad b0 d0 5d a4-07 47 97 66 46 88 2c 7e   l.....]..G.fF.,~
    0080 - 8c 61 79 17 56 e1 aa 80-2a 33 c2 9f 21 71 51 b2   .ay.V...*3..!qQ.
    0090 - 16 f6 a5 29 98 7b b3 e7-73 f0 df 88 f2 56 df fa   ...).{..s....V..
    00a0 - 94 10 e0 da 3c 41 65 1f-28 37 b8 34 0a 13 96 e3   ....<Ae.(7.4....
    00b0 - 49 16 14 0b 31 aa bc f7-d8 9a 83 05 dc 19 e7 f0   I...1...........
    00c0 - 74 07 e4 35 6c 65 33 de-6d 0a 2c 07 82 e6 4d e2   t..5le3.m.,...M.

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: F706A8D5FB8A59F379D588528A382372E116D92D7D0DA42D6533B4F63D7667ED
    Session-ID-ctx:
    Resumption PSK: 222B5500FBE8111E0343E8348B2BDB0E9BFDDBADC7CE1766E7D780B4FE09447BA63333F3E2A44ABB96E03A24E867BB8A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - 00 b7 e6 63 5f 88 45 78-6c 6c 18 a7 48 61 df 04   ...c_.Exll..Ha..
    0020 - cd 3c 15 e3 39 3d ed fb-35 a4 86 6e 78 d5 58 3e   .<..9=..5..nx.X>
    0030 - 72 b7 9c f1 45 b5 39 40-a9 e1 cc b4 89 73 70 6f   r...E.9@.....spo
    0040 - b0 b2 99 66 0a 6c fb d4-a7 e8 3d 29 31 16 30 3c   ...f.l....=)1.0<
    0050 - 02 1b e0 9c f1 9e 8d ae-9b 82 fc 29 a8 09 1f ad   ...........)....
    0060 - 7b b8 e3 b7 22 cc f2 ff-61 8e 0a 95 ec 0b 49 70   {..."...a.....Ip
    0070 - 9d d7 67 44 73 9c 7f c3-13 14 a8 d8 e3 4c 45 ff   ..gDs........LE.
    0080 - 42 b0 5f 9d 1a 9a f4 06-fc ba 3d 8e 9d 84 ce f8   B._.......=.....
    0090 - ca 89 bf 00 e7 a7 b2 d3-de 7a e0 e6 d9 08 a5 01   .........z......
    00a0 - 2a 89 be 69 7c 5d 56 d2-49 28 5e ea f7 55 f1 52   *..i|]V.I(^..U.R
    00b0 - 16 5e 33 c8 e1 a5 82 81-71 4c 2b b5 ba 0b 69 45   .^3.....qL+...iE
    00c0 - d7 da 8b a3 65 51 4a 66-af 5d f2 00 33 de 36 7b   ....eQJf.]..3.6{

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
JQttfApK4SeyHwDlI9SXGR50qclOAil1
Correct!
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

closed

 

/etc/tmp/patrache25 디렉토리 생성후 

key.private 파일을 생성하여  begin부터 end 까지 붙여넣기 후 chmod 600 key.private 한다.

bandit16@bandit:/tmp/patrache25$ ll
total 408
drwxrwxr-x    2 bandit16 bandit16   4096 Nov 17 01:41 ./
drwxrwx-wt 2115 root     root     405504 Nov 17 01:43 ../
-rw-------    1 bandit16 bandit16   1675 Nov 17 01:41 key.private
bandit16@bandit:/tmp/patrache25$ cat key.private
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

 

이제 key로 bandit17로 접속하면 끝

bandit16@bandit:/tmp/patrache25$ ssh -i key.private bandit17@localhost -p2220

bandit17@bandit:~$ cat /etc/bandit_pass/bandit17
VwOSWtCA7lRKkTfbr2IDh6awj9RNZM5e
저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 15 -> Level 16(openssl s_client)  (0) 2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet)  (0) 2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i)  (0) 2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d)  (0) 2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환)  (1) 2023.11.15
 

Bandit Level 15 → Level 16

Level Goal

The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

 

다음 레벨의 비밀번호를 얻기위해 현제 레벨의 30001포트로 SSL encrypion을 사용하여 접속하라

 

Commands you may need to solve this level들을 찾아보니 

openssl의 s_client 옵션이 있다.

 

https://kimkmg.tistory.com/44

 

OpenSSL 과 s_client

OpenSSL SSL/TLS 프로토콜을 구현한 라이브러리 중 하나로, 통신전문과 문서를 암호화 할 수 있음 s_client (SSL/TLS client program) SSL/TLS 를 사용하는 원격 호스트에 접속하기 위한 일반적인 SSL/TLS client를

kimkmg.tistory.com

 

 

bandit14@bandit:~/.ssh$ openssl s_client localhost:30001
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = localhost
verify error:num=10:certificate has expired
notAfter=Nov 14 21:28:40 2023 GMT
verify return:1
depth=0 CN = localhost
notAfter=Nov 14 21:28:40 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = localhost
   i:CN = localhost
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Nov 14 21:27:40 2023 GMT; NotAfter: Nov 14 21:28:40 2023 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDCzCCAfOgAwIBAgIEM6RIkjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMjMxMTE0MjEyNzQwWhcNMjMxMTE0MjEyODQwWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1
wifvEdFWIeI2PJy/Ahfb5tN0GZ944HsRBxLC3vFvUqVimmxRSgEwmZ9iYbhI/dLQ
TqyNCAZqE1AVaYfkFr7SFoLQ+3OIZbnEy4JSNlSWHdgnoObBwpz9aFKnTy2yI5LV
6Ep7nReXr/xpRpl2b/WS41WhKrg8eR3CkE9Vc3XFUqBdB+PBJRhAT5cPhYkCZVWo
b00JKC+jO96YfXzZ8zg72L10sKUeIUoA5/npKi1t4wG6dVCGyi5svPIv2pNBxJCq
M50hpaN9LB88+hZl+zRqIfcVzMsHDK06kHGIiEr4L24aMO+OD8lRThtBZ7yYkNN3
XR0rgJR79/+1WEHZ03RFAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBL
BglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4g
U2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4IBAQA8
H1DosaYoBW1zkfNg/Xj7+sd/ReR3BcDjg3bDUN3dpNBSKxUHvxo2WttPcLQY/4Zq
fzHxKTWuqMrGEoiZN7vE46cVcjRePDoCLWq4QoIfWeNcIVUGjtOwdPFqQSrignTb
g7qD1NOh4NFWRub7NxoRlywqtWeUfXBQ5XGI82tJzZa4qib2BGOuB6rOPSWZbwaV
JKThaMGm+hky40ZvnPc70HDXpED3DFuWyexvsfpSsGU+uFoQ0ULbtnOkWbWfFFHL
db9NauNMnGGozRbOvKhTWpMxA2GYVSXtsawKmf93do3UOCWVTo+pkfhqhJolmWXm
W/RG59GpXpt37aWvGnX3
-----END CERTIFICATE-----
subject=CN = localhost
issuer=CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1339 bytes and written 373 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 376B1A05858513EC8D5259E5770D33FDEC887E074D932D075160097F7066839F
    Session-ID-ctx:
    Resumption PSK: 448ED7C212C91F5FF5F06304A7F93E3FFE2B764697450FF1BA19C0FAE5B8743F6B5F4B13F0A6EC2C9B7E524F5BCA57F6
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 00 ce 70 c8 45 c4 d3 37-32 1f 89 92 6a ab 5a 57   ..p.E..72...j.ZW
    0010 - 98 12 98 8b 15 07 5e 3f-73 6b b2 13 e7 69 df f0   ......^?sk...i..
    0020 - 9a b3 2a 25 45 13 44 03-23 8a b0 e8 24 26 09 1e   ..*%E.D.#...$&..
    0030 - d2 b7 c3 b8 96 5a ee 32-ab 4f 39 ae 84 0a 39 ef   .....Z.2.O9...9.
    0040 - 22 0a 14 ba ca 5c 11 2b-b2 92 79 6e 41 f8 b3 7e   "....\.+..ynA..~
    0050 - 78 24 f4 5a 08 73 75 52-90 29 e8 cd 43 4f 55 d4   x$.Z.suR.)..COU.
    0060 - 2a 7a 64 93 23 2f e0 4d-9d 95 8c 85 14 ec ae d2   *zd.#/.M........
    0070 - 74 87 ff 0a 11 c1 c5 f0-85 cf b7 33 3b 6e 81 41   t..........3;n.A
    0080 - 18 39 64 67 dd 3e 0b 39-87 f2 e3 80 f3 77 e5 8b   .9dg.>.9.....w..
    0090 - 53 cd 35 2b d4 d4 e5 db-86 cc 0e 17 b2 22 71 63   S.5+........."qc
    00a0 - e3 ed f1 d0 a0 ca 26 c3-f8 ab f8 2e 41 65 ae 4a   ......&.....Ae.J
    00b0 - 21 7d 76 17 fa f2 b5 1d-ad 8b 47 89 dd 52 ab 33   !}v.......G..R.3
    00c0 - 55 e0 db 13 9f 6e 4a 7c-00 85 e4 7c fe ea f1 85   U....nJ|...|....

    Start Time: 1700182691
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 8EA9A947757D4C2B632BE5C1474C8D53900AAA61B6B262074A188581E8C738F2
    Session-ID-ctx:
    Resumption PSK: 5F434F8EE5043076AE0B0D47636FAD326A21939F3C1545FB3AD557A310257BCDA119C5EC33CDC3FBA5C18521932B757C
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 00 ce 70 c8 45 c4 d3 37-32 1f 89 92 6a ab 5a 57   ..p.E..72...j.ZW
    0010 - 95 37 23 8f 95 c4 89 21-7c 6f 9e 88 11 bd ea 26   .7#....!|o.....&
    0020 - 66 57 fb b4 bc b8 19 f7-d7 31 4b 05 2f 36 a9 02   fW.......1K./6..
    0030 - 3a 39 e8 82 b0 6b 6c bb-f1 56 d8 08 cd b0 a1 a9   :9...kl..V......
    0040 - 09 e6 0b 39 9a 94 09 a0-b2 6a 15 8b 8f 63 90 be   ...9.....j...c..
    0050 - 09 8b ea 58 90 7f 45 ce-66 ca 3a 07 e7 75 6e 3b   ...X..E.f.:..un;
    0060 - 8e 7a b7 32 6b c3 44 db-18 70 2f b2 e1 f4 a7 83   .z.2k.D..p/.....
    0070 - 31 e6 3e e1 e8 f3 05 e4-22 00 45 61 4f 37 89 22   1.>.....".EaO7."
    0080 - 38 8b 25 07 8b ca 15 b1-db 1f 2a 12 b7 b7 38 d9   8.%.......*...8.
    0090 - b0 93 57 fa 8e 7c 8f 25-81 a2 37 bc 73 78 49 87   ..W..|.%..7.sxI.
    00a0 - b5 ee 55 62 5d 5d ee 99-62 3c d6 b1 27 0c 1a bf   ..Ub]]..b<..'...
    00b0 - 19 43 b1 24 8b 32 48 4b-1d 02 cf 6a 14 22 35 3b   .C.$.2HK...j."5;
    00c0 - 79 e9 16 14 f4 ae 54 b2-80 40 00 20 6a 05 4c a6   y.....T..@. j.L.

    Start Time: 1700182691
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt
Correct!
JQttfApK4SeyHwDlI9SXGR50qclOAil1

closed

 

이해가 잘 안간다.

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 16 -> Level 17  (0) 2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet)  (0) 2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i)  (0) 2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d)  (0) 2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환)  (1) 2023.11.15

Bandit Level 14 → Level 15

Level Goal

The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

다음 레의 비밀번호를 업기위해 현재 레벨의 30000번 포트로 접속해라.

bandit14@bandit:~$ telnet --help
telnet: invalid option -- '-'
Usage: telnet [-4] [-6] [-8] [-E] [-L] [-a] [-d] [-e char] [-l user]
        [-n tracefile] [ -b addr ] [-r] [host-name [port]]
        
bandit14@bandit:~$ telnet localhost 30000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq
Correct!
jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt

Connection closed by foreign host.

30000포트로 접속 후 bandit14의 비밀번호를 기입하니 다음 레벨의 비밀번호가 나왔다.

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 16 -> Level 17  (0) 2023.11.17
Bandit WarGame Level 15 -> Level 16(openssl s_client)  (0) 2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i)  (0) 2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d)  (0) 2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환)  (1) 2023.11.15

Bandit Level 13 → Level 14

Level Goal

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

 

비밀번호는 /etc/bandit_pass/bandit14에 있으며  bandit14의 사용자만 읽을 수 있다. 현재의 권한으로는 bandit14의 비밀번호를 얻을 수 없지만 ssh를 통해 다음 레벨로 진행 할 수 있다.

 

bandit13@bandit:~$ ll
total 24
drwxr-xr-x  2 root     root     4096 Oct  5 06:19 ./
drwxr-xr-x 70 root     root     4096 Oct  5 06:20 ../
-rw-r--r--  1 root     root      220 Jan  6  2022 .bash_logout
-rw-r--r--  1 root     root     3771 Jan  6  2022 .bashrc
-rw-r--r--  1 root     root      807 Jan  6  2022 .profile
-rw-r-----  1 bandit14 bandit13 1679 Oct  5 06:19 sshkey.private
bandit13@bandit:~$ ssh -help
unknown option -- h
usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]
           [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]
           [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]
           [-i identity_file] [-J [user@]host[:port]] [-L address]
           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]
           [-w local_tun[:remote_tun]] destination [command [argument ...]]

 

sshkey.private 파일이 확인된다. ssh로 접속 할 때 비밀번호 대신 사용되는 키로 보인다. 해당 키를 사용 할수 있는 옵션을 찾기위해 ssh -help로 옵션을 찾아보니 [ -i identy_file ] 옵션이 보인다.

 

key를 사용하여 bandit14로 접속

bandit14@bandit:~$ cat /etc/bandit_pass/bandit14
fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq

 

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 15 -> Level 16(openssl s_client)  (0) 2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet)  (0) 2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d)  (0) 2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환)  (1) 2023.11.15
Bandit WarGame Level 10 -> Level 11(base64)  (2) 2023.11.15

+ Recent posts

티스토리툴바