Bandit 16
Objectives
Level GoalThe password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.
Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…
Solution
bandit15@bandit:~$ echo BfMYroe26WYalil77FoDi9qh59eK5xNr | openssl s_client -ign_eof -connect localhost:30001CONNECTED(00000003)depth=0 CN = localhostverify error:num=18:self signed certificateverify return:1depth=0 CN = localhostverify return:1---Certificate chain 0 s:/CN=localhost i:/CN=localhost---Server certificate-----BEGIN CERTIFICATE-----MIICBjCCAW+gAwIBAgIEBadydTANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwHhcNMTkwMjI3MDg1MTQ5WhcNMjAwMjI3MDg1MTQ5WjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMyEZzRA+5ll7Ap2bwla+8x39mTviZKqrjnmLuTZj1U3mugt3G2JI5loXyjnFxlXnHUGy/xIOiACFOEJCce2VIkarMa1Cy13wtGuLoZxjcYSAIMzIOPykCh9+FJ89Tt1TIVXmO0CTJaxFMhKdX0ALZlxjN1+xoZgeOtN7yfhprjjAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBLBglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4gU2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4GBACNP1/t8pfANluA2MuoxCAkie0bDCUL/ZV7FDaH1YUAEG7wEZVFJPt8+6L8HkLYcuCPtjc2uxA8yEiqS7fiYRU26PmrQXzm09W0ah1pq+7NGMLKz596BAIpiTkVpA7YCUvGcYvz6yXS202e2GbLOulF2l9kx6hhhBCWubeqh2IjR-----END CERTIFICATE-----subject=/CN=localhostissuer=/CN=localhost---No client certificate CA names sentPeer signing digest: SHA512Server Temp Key: X25519, 253 bits---SSL handshake has read 1019 bytes and written 269 bytesVerification error: self signed certificate---New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384Server public key is 1024 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 44478770157CC92CC115519B8669DEAEDF5BE611B3CBF3A68BAD59DAC19061D3 Session-ID-ctx: Master-Key: 502DE099D6BF9CA7EAEC5A2BAF971B4ECBE66F8674B17AFC7A35DAED79AD9F43C7C1165C22016D86915850C97A56923A PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 7200 (seconds) TLS session ticket: 0000 - df 12 86 44 83 09 d4 62-75 55 25 0c f8 4f 2c 53 ...D...buU%..O,S 0010 - 71 95 96 18 78 eb 55 95-cd b2 88 5e 89 65 63 64 q...x.U....^.ecd 0020 - ce 91 d2 f8 87 70 b8 90-a7 6c 51 b5 8f 84 0c a9 .....p...lQ..... 0030 - 2a 1d 54 bc 6d bc 50 f9-34 dc 86 7f 32 e1 f1 7a *.T.m.P.4...2..z 0040 - fb c4 63 f6 8c b1 fe 1b-53 9e 9a fa 73 07 33 d5 ..c.....S...s.3. 0050 - 69 31 c9 b7 b3 bb d7 11-12 af 5f 47 22 9c 51 95 i1........_G".Q. 0060 - 5a ad 2c 73 a8 80 07 96-cf 11 ab af 3c 0c 6f 8d Z.,s........<.o. 0070 - 3c ca b7 0d f6 e6 b5 98-59 65 31 2a fa c5 ec e4 <.......Ye1*.... 0080 - 9a a3 c0 89 f9 3f 3a 67-1b a4 81 09 1e e4 cc c2 .....?:g........ 0090 - 62 76 65 07 af a6 78 29-b1 6c 17 c8 37 6a a5 be bve...x).l..7j..
password is
cluFn7wTiGryunymYOu4RcffSxQluehd
Now in Python
Objectives
Level GoalThe password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.
Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…
Solution
bandit15@bandit:~$ echo BfMYroe26WYalil77FoDi9qh59eK5xNr | openssl s_client -ign_eof -connect localhost:30001CONNECTED(00000003)depth=0 CN = localhostverify error:num=18:self signed certificateverify return:1depth=0 CN = localhostverify return:1---Certificate chain 0 s:/CN=localhost i:/CN=localhost---Server certificate-----BEGIN CERTIFICATE-----MIICBjCCAW+gAwIBAgIEBadydTANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwHhcNMTkwMjI3MDg1MTQ5WhcNMjAwMjI3MDg1MTQ5WjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMyEZzRA+5ll7Ap2bwla+8x39mTviZKqrjnmLuTZj1U3mugt3G2JI5loXyjnFxlXnHUGy/xIOiACFOEJCce2VIkarMa1Cy13wtGuLoZxjcYSAIMzIOPykCh9+FJ89Tt1TIVXmO0CTJaxFMhKdX0ALZlxjN1+xoZgeOtN7yfhprjjAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBLBglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4gU2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4GBACNP1/t8pfANluA2MuoxCAkie0bDCUL/ZV7FDaH1YUAEG7wEZVFJPt8+6L8HkLYcuCPtjc2uxA8yEiqS7fiYRU26PmrQXzm09W0ah1pq+7NGMLKz596BAIpiTkVpA7YCUvGcYvz6yXS202e2GbLOulF2l9kx6hhhBCWubeqh2IjR-----END CERTIFICATE-----subject=/CN=localhostissuer=/CN=localhost---No client certificate CA names sentPeer signing digest: SHA512Server Temp Key: X25519, 253 bits---SSL handshake has read 1019 bytes and written 269 bytesVerification error: self signed certificate---New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384Server public key is 1024 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 44478770157CC92CC115519B8669DEAEDF5BE611B3CBF3A68BAD59DAC19061D3 Session-ID-ctx: Master-Key: 502DE099D6BF9CA7EAEC5A2BAF971B4ECBE66F8674B17AFC7A35DAED79AD9F43C7C1165C22016D86915850C97A56923A PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 7200 (seconds) TLS session ticket: 0000 - df 12 86 44 83 09 d4 62-75 55 25 0c f8 4f 2c 53 ...D...buU%..O,S 0010 - 71 95 96 18 78 eb 55 95-cd b2 88 5e 89 65 63 64 q...x.U....^.ecd 0020 - ce 91 d2 f8 87 70 b8 90-a7 6c 51 b5 8f 84 0c a9 .....p...lQ..... 0030 - 2a 1d 54 bc 6d bc 50 f9-34 dc 86 7f 32 e1 f1 7a *.T.m.P.4...2..z 0040 - fb c4 63 f6 8c b1 fe 1b-53 9e 9a fa 73 07 33 d5 ..c.....S...s.3. 0050 - 69 31 c9 b7 b3 bb d7 11-12 af 5f 47 22 9c 51 95 i1........_G".Q. 0060 - 5a ad 2c 73 a8 80 07 96-cf 11 ab af 3c 0c 6f 8d Z.,s........<.o. 0070 - 3c ca b7 0d f6 e6 b5 98-59 65 31 2a fa c5 ec e4 <.......Ye1*.... 0080 - 9a a3 c0 89 f9 3f 3a 67-1b a4 81 09 1e e4 cc c2 .....?:g........ 0090 - 62 76 65 07 af a6 78 29-b1 6c 17 c8 37 6a a5 be bve...x).l..7j..
Start Time: 1559235643 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) Extended master secret: yes---Correct!cluFn7wTiGryunymYOu4RcffSxQluehd
closed
password is
cluFn7wTiGryunymYOu4RcffSxQluehd
Now in Python
import os
os.system('echo BfMYroe26WYalil77FoDi9qh59eK5xNr | openssl s_client -ign_eof -connect localhost:30001')
***Again this this is kind of cheating to call this a python solution***
Comments
Post a Comment