diff --git a/content/posts/overthewire-bandit-6-7.md b/content/posts/overthewire-bandit-6-7.md index 67a3d0e..b029798 100644 --- a/content/posts/overthewire-bandit-6-7.md +++ b/content/posts/overthewire-bandit-6-7.md @@ -21,4 +21,56 @@ Password: `HWasnPhtq9AVKe0dmk45nxy20cvUa6EG` # Theory +The process to solve this task is pretty similar to the previous level, we just need the `find` command with some different attribute, `-user [username]` searches for files owned by a specific user and `-group [groupname]` searches for files owned by a specific group. +# Solution + +1. Log in to the remote machine with the credentials previously found. + +``` +~$: ssh bandit6@bandit.labs.overthewire.org -p 2220 +``` + +2. To find the right file we will user the find command with some attributes: + +``` +bandit6@bandit~$: find / -type f -user bandit7 -group bandit6 -size 33c +... +find: ‘/etc/stunnel’: Permission denied +find: ‘/etc/multipath’: Permission denied +find: ‘/etc/sudoers.d’: Permission denied +find: ‘/etc/credstore.encrypted’: Permission denied +find: ‘/etc/ssl/private’: Permission denied +find: ‘/etc/credstore’: Permission denied +find: ‘/etc/xinetd.d’: Permission denied +find: ‘/etc/polkit-1/rules.d’: Permission denied +find: ‘/root’: Permission denied +find: ‘/tmp’: Permission denied +find: ‘/lost+found’: Permission denied +find: ‘/dev/shm’: Permission denied +find: ‘/dev/mqueue’: Permission denied +find: ‘/var/spool/bandit24’: Permission denied +find: ‘/var/spool/rsyslog’: Permission denied +find: ‘/var/spool/cron/crontabs’: Permission denied +find: ‘/var/lib/udisks2’: Permission denied +/var/lib/dpkg/info/bandit7.password +find: ‘/var/lib/snapd/void’: Permission denied +find: ‘/var/lib/snapd/cookie’: Permission denied +find: ‘/var/lib/ubuntu-advantage/apt-esm/var/lib/apt/lists/partial’: Permission denied +find: ‘/var/lib/private’: Permission denied +find: ‘/var/lib/update-notifier/package-data-downloads/partial’: Permission denied +find: ‘/var/lib/amazon’: Permission denied +... +``` + +To avoid this kind of output we can add a piece of code at the end of the command to suppress error messages: + +``` +bandit6@bandit~$: find / -type f -user bandit7 -group bandit6 -size 33c 2>/dev/null +/var/lib/dpkg/info/bandit7.password + +bandit6@bandit~$: cat /var/lib/dpkg/info/bandit7.password +morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj +``` + +3. Now we can move to the next level. diff --git a/public/404.html b/public/404.html index 5215f19..1c3eb76 100644 --- a/public/404.html +++ b/public/404.html @@ -1,5 +1,5 @@ -404 Page not found | Kaliban's Blog -
404