Over the Wire - Bandit 7

Bandit 7


Objectives
Level GoalThe password for the next level is stored somewhere on the server and has all of the following properties:

• owned by user bandit7
• owned by group bandit6
• 33 bytes in size

Solution

so we are looking for a file owned by user bandit7 and group bandit 6 somwhere on the server......

I started by cd .. all the way up to root
with the comman find * -user bandit7 -group bandit6

bandit6@bandit:/$ find * -user bandit7 -group bandit6find: ‘boot/lost+found’: Permission deniedfind: ‘cgroup2/csessions’: Permission deniedfind: ‘etc/ssl/private’: Permission deniedfind: ‘etc/lvm/backup’: Permission deniedfind: ‘etc/lvm/archive’: Permission deniedfind: ‘etc/polkit-1/localauthority’: Permission deniedfind: ‘home/bandit28-git’: Permission deniedfind: ‘home/bandit30-git’: Permission deniedfind: ‘home/bandit31-git’: Permission deniedfind: ‘home/bandit5/inhere’: Permission deniedfind: ‘home/bandit27-git’: Permission deniedfind: ‘home/bandit29-git’: Permission deniedfind: ‘lost+found’: Permission deniedfind: ‘proc/tty/driver’: Permission deniedfind: ‘proc/30734/task/30734/fd/6’: No such file or directoryfind: ‘proc/30734/task/30734/fdinfo/6’: No such file or directoryfind: ‘proc/30734/fd/5’: No such file or directoryfind: ‘proc/30734/fdinfo/5’: No such file or directoryfind: ‘root’: Permission deniedfind: ‘run/lvm’: Permission deniedfind: ‘run/screen/S-bandit0’: Permission deniedfind: ‘run/screen/S-bandit13’: Permission deniedfind: ‘run/screen/S-bandit1’: Permission deniedfind: ‘run/screen/S-bandit10’: Permission deniedfind: ‘run/screen/S-bandit4’: Permission deniedfind: ‘run/screen/S-bandit3’: Permission deniedfind: ‘run/screen/S-bandit22’: Permission deniedfind: ‘run/screen/S-bandit18’: Permission deniedfind: ‘run/screen/S-bandit17’: Permission deniedfind: ‘run/screen/S-bandit25’: Permission deniedfind: ‘run/screen/S-bandit9’: Permission deniedfind: ‘run/screen/S-bandit16’: Permission deniedfind: ‘run/screen/S-bandit5’: Permission deniedfind: ‘run/screen/S-bandit19’: Permission deniedfind: ‘run/screen/S-bandit7’: Permission deniedfind: ‘run/screen/S-bandit33’: Permission deniedfind: ‘run/screen/S-bandit29’: Permission deniedfind: ‘run/screen/S-bandit28’: Permission deniedfind: ‘run/screen/S-bandit27’: Permission deniedfind: ‘run/screen/S-bandit21’: Permission deniedfind: ‘run/screen/S-bandit15’: Permission deniedfind: ‘run/screen/S-bandit31’: Permission deniedfind: ‘run/screen/S-bandit30’: Permission deniedfind: ‘run/screen/S-bandit14’: Permission deniedfind: ‘run/screen/S-bandit2’: Permission deniedfind: ‘run/screen/S-bandit24’: Permission deniedfind: ‘run/screen/S-bandit23’: Permission deniedfind: ‘run/screen/S-bandit20’: Permission deniedfind: ‘run/shm’: Permission deniedfind: ‘run/lock/lvm’: Permission deniedfind: ‘sys/fs/pstore’: Permission deniedfind: ‘tmp’: Permission deniedfind: ‘var/spool/bandit24’: Permission deniedfind: ‘var/spool/rsyslog’: Permission deniedfind: ‘var/spool/cron/crontabs’: Permission deniedfind: ‘var/log’: Permission deniedfind: ‘var/tmp’: Permission deniedfind: ‘var/cache/ldconfig’: Permission deniedfind: ‘var/cache/apt/archives/partial’: Permission deniedvar/lib/dpkg/info/bandit7.passwordfind: ‘var/lib/apt/lists/partial’: Permission deniedfind: ‘var/lib/polkit-1’: Permission denied

I see something towards the end that is probably what we are looking for but lets get rid of all those permission denied entrys

bandit6@bandit:/$ find * -user bandit7 -group bandit6 2>/dev/nullvar/lib/dpkg/info/bandit7.password

Much better  there is a file in /var/lib/dpkg/info called bandit7password  I'm pretty sure that the file we are looking for but lets take a look at the size just to be sure

bandit6@bandit:/$ ls /var/lib/dpkg/info/ -ls | grep 'bandit7.password'   4 -rw-r----- 1 bandit7 bandit6      33 Oct 16  2018 bandit7.password

Yup 33k

lets see what's in there

bandit6@bandit:/$ cat /var/lib/dpkg/info/bandit7.passwordHKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs

Cool found this one using bash..... now i'll spend some time torturing my self to figure out how to do it in python :)

so here is what I pieced together in python

I re-used a lot of the code from the last bandit

Added os.stat(filevar).st_uid to get the user #
Added os.stat(filevar).st_gid to get the group #

converted those to names using 
pwd.getpwuid(varfileonwer)[0]
grp.getgrid(varfilegroup)[0]

then added a couple of and to my If statement to check if the owner and group names matched those in the instruction

since we are walking whole directory structure of /   I found a little snippet on the interwebs to redirect error messsages to DevNull to keep them from printing on the screen

#Import os moduleimport os#Import math and time moduleimport math,time,grp,pwd,sys

class DevNull:    def write(self, msg):        pass

#Set listing start location
dir_count = 0file_count = 0
#Traverse directory treefor (path,dirs,files) in os.walk(os.curdir):        dir_count += 1    #Repeat for each file in directory    for file in files:     try :      filevar = os.path.join(path,file)      #print('filevar is',filevar)      varfilesize =  os.path.getsize(filevar)      varfileowner = os.stat(filevar).st_uid      varfilegroup = os.stat(filevar).st_gid      varfileownername = pwd.getpwuid(varfileowner)[0]      varfilegroupname = grp.getgrgid(varfilegroup)[0]      if varfilesize == 33 and varfileownername == 'bandit7' and varfilegroupname == 'bandit6':       print('Bingo file found*****************************')       print(filevar,varfilesize)       print('onwer is ',varfileownername)       print('group is ',varfilegroupname)       filetmp = open(filevar)       filetmp.read()     except Exception as err:       sys.stderr = DevNull()     file_count += 1

​
Here is the output of the python script

Bingo file found*****************************('./var/lib/dpkg/info/bandit7.password', 33)('onwer is ', 'bandit7')('group is ', 'bandit6')'HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs\n'Bingo file found*****************************('./proc/1521/task/1521/fd/4', 33)('onwer is ', 'bandit7')('group is ', 'bandit6')'HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs\n'Bingo file found*****************************('./proc/1521/fd/3', 33)('onwer is ', 'bandit7')('group is ', 'bandit6')'HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs\n'Bingo file found*****************************('./proc/1521/fd/4', 33)('onwer is ', 'bandit7')('group is ', 'bandit6')'HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs\n'

​