Over the Wire - Bandit 22

Bandit 22


Objective
A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.


Solution

lets see what's in cron.d

bandit21@bandit:~$ cd  /etc/cron.dbandit21@bandit:/etc/cron.d$ lscronjob_bandit22  cronjob_bandit23  cronjob_bandit24

cool there is a file called cronjob_bandit22 lets see whats inside

bandit21@bandit:/etc/cron.d$ cat cronjob_bandit22@reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null

ok lets see whats in that file

#!/bin/bashchmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgvcat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

let's decode that a bit

ok there is a chmod which change the permissions for a file in the tmp directory named t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
which give the owner of the file read/write but not execute permissions
it also sets read rights for the group of the owner and other users too

lets cat the file and see what's inside

bandit21@bandit:/etc/cron.d$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgvYk7owGAcWjwMVRwrTesJEwB7WVOiILLI

I'm not really sure how to do this in python so I'm going to skip this for now