OverTheWire

Bandit

Level 0

sshpass -p bandit0 ssh bandit0@bandit.labs.overthewire.org -p 2220

Level 0 → Level 1

sshpass -p bandit0 ssh bandit0@bandit.labs.overthewire.org -p 2220
cat readme

Level 1 → Level 2

sshpass -p ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If ssh bandit1@bandit.labs.overthewire.org -p 2220
cat ./-

Level 2 → Level 3

sshpass -p 263JGJPfgU6LtdEvgfWU1XP5yac29mFx ssh bandit2@bandit.labs.overthewire.org -p 2220
cat spaces\ in\ this\ filename 

Level 3 → Level 4

sshpass -p MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx ssh bandit3@bandit.labs.overthewire.org -p 2220
cd inhere/
cat ...Hiding-From-You

Level 4 → Level 5

sshpass -p 2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ ssh bandit4@bandit.labs.overthewire.org -p 2220
cd inhere/
find . -type f -exec file {} + | grep ASCII | cut -d: -f1 | xargs cat

Level 5 → Level 6

sshpass -p 4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw ssh bandit5@bandit.labs.overthewire.org -p 2220
find . -type f -size 1033c -exec cat {} + | sed 's/ //g'

Level 6 → Level 7

sshpass -p HWasnPhtq9AVKe0dmk45nxy20cvUa6EG ssh bandit6@bandit.labs.overthewire.org -p 2220
find / -size 33c -user bandit7 -group bandit6 2> /dev/null -exec cat {} +
find / -user bandit7 -group bandit6 -size 33c 2>/dev/null -exec cat {} \;

Level 7 → Level 8

sshpass -p morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj ssh bandit7@bandit.labs.overthewire.org -p 2220
grep -n "millionth" data.txt | cut -f2 -d:
cat data.txt | grep "millionth"

Level 8 → Level 9

sshpass -p dfwvzFQi4mU0wfNbFOe9RoWskMLg7eEc ssh bandit8@bandit.labs.overthewire.org -p 2220
sort data.txt | uniq -u

Level 9 → Level 10

sshpass -p 4CKMh1JI91bUIZZPXDqGanal4xvAg0JM ssh bandit9@bandit.labs.overthewire.org -p 2220
strings data.txt | grep '=='

Level 10 → Level 11

sshpass -p FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey ssh bandit10@bandit.labs.overthewire.org -p 2220
base64 --decode data.txt 

Level 11 → Level 12

Caesar cipher

sshpass -p dtR173fZKb0RRsDFSGsg2RWnpNVj3qRr ssh bandit11@bandit.labs.overthewire.org -p 2220
cat data.txt | tr '[A-Za-z]' '[N-ZA-Mn-za-m]'

Level 12 → Level 13

sshpass -p 7x16WNeHIi5YkIhWsfFIqoognUTyj9Q4 ssh bandit12@bandit.labs.overthewire.org -p 2220
rm -r /tmp/tmp_bandit12
mkdir /tmp/tmp_bandit12
cd /tmp/tmp_bandit12
cp ~/data.txt .
xxd -r data.txt > bdata
mv bdata bdata.gz
gunzip bdata.gz
mv bdata bdata.bz2
bzip2 -d bdata.bz2
mv bdata bdata.gz
gunzip bdata.gz
tar -xf bdata
tar -xf data5.bin
bzip2 -d data6.bin
tar -xf data6.bin.out
mv data8.bin data8.bin.gz
gunzip data8.bin.gz
cat data8.bin
rm -r /tmp/tmp_bandit12

Level 13 → Level 14

sshpass -p FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn ssh bandit13@bandit.labs.overthewire.org -p 2220
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i sshkey.private bandit14@bandit.labs.overthewire.org -p 2220
cat /etc/bandit_pass/bandit14

Level 14 → Level 15

sshpass -p MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS ssh bandit14@bandit.labs.overthewire.org -p 2220
telnet localhost 30000
MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS

Level 15 → Level 16

sshpass -p 8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo ssh bandit15@bandit.labs.overthewire.org -p 2220
openssl s_client -connect localhost:30001
8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo

Level 16 → Level 17

PORT      STATE SERVICE     VERSION
31046/tcp open  echo
31518/tcp open  ssl/echo
31691/tcp open  echo
31790/tcp open  ssl/unknown
31960/tcp open  echo

sshpass -p kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx ssh bandit16@bandit.labs.overthewire.org -p 2220
#nmap -sV localhost -p 31000-32000
rm -r /tmp/sshme
mkdir /tmp/sshme && cd $_
echo kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx | openssl s_client -connect localhost:31790 -ign_eof > /tmp/sshme/rsa_key
chmod 600 rsa_key
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i rsa_key bandit17@bandit.labs.overthewire.org -p 2220

Level 17 → Level 18

diff passwords.new passwords.old

Level 18 → Level 19

sshpass -p x2gLTTjFwMOhQ8oWNbMN362QKxfRqGlO ssh bandit18@bandit.labs.overthewire.org -p 2220 cat readme

Level 19 → Level 20

sshpass -p cGWpMaKXVwDUNgPAVJbWYuGHVn9zl3j8 ssh bandit19@bandit.labs.overthewire.org -p 2220
./bandit20-do cat /etc/bandit_pass/bandit20

Level 20 → Level 21

sshpass -p 0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO ssh bandit20@bandit.labs.overthewire.org -p 2220
echo -n '0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO' | nc -l -p 1234 & [1] 24661
./suconnect 1234

Level 21 → Level 22

sshpass -p EeoULMCra2q0dSkYj561DX7s1CpBuOBt ssh bandit21@bandit.labs.overthewire.org -p 2220
cd /etc/cron.d
cat /usr/bin/cronjob_bandit22.sh
cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

Level 22 → Level 23

sshpass -p tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q ssh bandit22@bandit.labs.overthewire.org -p 2220
cd /etc/cron.d/
cat /usr/bin/cronjob_bandit23.sh
echo I am user $myname | md5sum | cut -d ' ' -f 1
cat /tmp/$(!!)
cat /tmp/$(echo I am user bandit23 | md5sum | cut -d ' ' -f 1)

Level 23 → Level 24

sshpass -p 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga ssh bandit23@bandit.labs.overthewire.org -p 2220

Natas

Level 0

Username: natas0
Password: natas0
http://natas0.natas.labs.overthewire.org

Solution:
view-source:http://natas0.natas.labs.overthewire.org
<!--The password for natas1 is 0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq -->

Level 0 → Level 1

Username: natas1
Password: 0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq
http://natas1.natas.labs.overthewire.org

Solution:
view-source:http://natas1.natas.labs.overthewire.org
<!--The password for natas2 is TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI -->

Level 1 → Level 2

Username: natas2
Password: TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI
http://natas2.natas.labs.overthewire.org

Solution:
http://natas2.natas.labs.overthewire.org/files/users.txt
natas3:3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH

Level 2 → Level 3

Username: natas3
Password: 3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH
http://natas3.natas.labs.overthewire.org

Solution:
brew install sidaf/pentest/dirb
https://gist.github.com/gmolveau/c6c1398b3351a99509c75d2d7bcaacc7
dirb http://natas3.natas.labs.overthewire.org/ -u natas3:3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH
http://natas3.natas.labs.overthewire.org/s3cr3t/users.txt
natas4:QryZXc2e0zahULdHrtHxzyYkj59kUxLQ