Skip to main content

Bandit CTF

Bandit CTF

ssh bandit7@bandit.labs.overthewire.org -p 2220

3 - UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK
4 - pIwrPrtPN36QITSp3EQaw936yaFoFgAB
5 - koReBOKuIDDepwhWk7jZC0RTdopnAYKh
6 - DXjZPULLxYr17uwoI01bNLQbtFemEgo7
7 - HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs /--> find / -size 33c -user bandit7 -group bandit6 2>/dev/null -->  cat /var/lib/dpkg/info/bandit7.password
8 - cvX2JJa4CFALtqS87jk27qwqGhBM9plV /--> grep "millionth" data.txt
9 - UsvVyFSfZZWbi6wgC7dAFyFuR6jQQUhR /--> cat data.txt | sort | uniq -c | grep 1 / unique value
10 -truKLdjsbJ5g7yyJ2X2R0o3a5HQJFuLk /--> strings data.txt | grep "==" /search for something with req text
11- IFukwKGsFW8MOq3IRFqrxE1hxTNEbUPR
12- 5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu /--> cat data.txt | tr a-zA-Z n-za-mN-ZA-M /find rot13 text
13- 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL
14- 4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e / ssh -i sshkey.private bandit14@localhost
15- BfMYroe26WYalil77FoDi9qh59eK5xNr /echo 4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e | nc localhost 30000
16- cluFn7wTiGryunymYOu4RcffSxQluehd /echo BfMYroe26WYalil77FoDi9qh59eK5xNr | openssl s_client -quiet -connect localhost:30001
17- xLYVMN9WE5zQ5vHacb0sZEVqbrp7nBTn /--> cat /etc/bandit_pass/bandit16 | openssl s_client -quiet -connect localhost:31790 -quiet >/tmp/key/key.private
    chmod 700 key.private --> ssh -i key.private bandit17@localhost --> cat /etc/bandit_pass/bandit17
18- kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd    /--> awk 'NR==FNR{a[$0];next}!($0 in a)' passwords.new passwords.old --> diff b/w 2 lines
    diff passwords.new passwords.old
    grep -vf passwords.old passwords.new
19- IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x /--> ssh bandit18@bandit.labs.overthewire.org -p 2220 cat readme
20-GbKksEFF4yrVs6il55v6gwY5aVje5f0j /-->  ./bandit20-do cat /etc/bandit_pass/bandit20




ougahZi8Ta

Comments

Popular posts from this blog

POC Links for CVE's

  Serach for a CVE here first - Trickest/cve Apache CVE-2024-38475 - CVE-2024-38475 #version less than 2.4.51 CVE-2021-44790 - h ttps://www.exploit-db.com/exploits/51193 #Apache HTTP Server 2.4.50 CVE-2021-42013 - https://www.exploit-db.com/exploits/50406 use https://github.com/mrmtwoj/apache-vulnerability-testing for below CVE's CVE-2024-38472: Apache HTTP Server on Windows UNC SSRF CVE-2024-39573: mod_rewrite proxy handler substitution CVE-2024-38477: Crash resulting in Denial of Service in mod_proxy CVE-2024-38476: Exploitable backend application output causing internal redirects CVE-2024-38475: mod_rewrite weakness with filesystem path matching CVE-2024-38474: Weakness with encoded question marks in backreferences CVE-2024-38473: mod_proxy proxy encoding problem CVE-2023-38709: HTTP response splitting EXIM #suppodily should work for versions below Exim 4.96.1 - is not accurate CVE-2023-42115 - https://github.com/AdaHop-Cyber-Security/Pocy/tree/main

Hash Extension Attacks

  #Install Dependencies sudo apt-get install libssl-dev #Download Hash Extender git clone https://github.com/iagox86/hash_extender.git cd hash_extender make #Run it /hash_extender --data 'username=admin' --secret 16 --append '&isLoggedIn=True' --signature d3a85d3b3087c7e841f84eb4316765c6e1f786074a1f1db996b2e0f8c96f197e2f55433920a630feb07daafadefbc13c947e5225fc509f8241f57f47a8df5311 --format sha512