Bandit Walkthrough – Level 15

Level Description

http://www.overthewire.org/wargames/bandit/bandit16.shtml

This level teaches you how to send information to a specific port on a device securely using SSL.

Hint

The password for bandit15 is located in the same place bandit14’s password was: /etc/bandit_pass/ – you will need to read the password out of this and pass it to port 30001 on the localhost. This process is pretty similar to level 14, only it uses the openssl command. You may hit a slight bump where you expect to have the next password returned to you, but end up only seeing “HEARTBEATING” or “read R BLOCK”. If you run into this, make sure to look back at the OTW page for their hint (or just look in to the spoilers below).

Solution	Select Show
Once again this is a pretty straight forward solution, though it may take a little time reading through the man page of the openssl command to get the syntax correct. As before we want to pipe the password from /etc/bandit_pass/bandit15 to the connection command. To connect we want to use openssl (openssl) as a client (s_client) to connect (-connect) to the localhost on port 30001 (localhost:30001). However when doing just that we run in to the problem that was warned about on the OTW page, so we must add the -quiet flag. I’ll be honest, I have not researched what exactly that does, and it is not in the man page, but since OTW explicitly advised us to try it, I figured I would and it worked. You will see the password appear just over the line reading “read:errno=0” [$]-> cat /etc/bandit_pass/bandit15 \| openssl s_client -connect localhost:30001 -quiet The password for bandit16 is: cluFn7wTiGryunymYOu4RcffSxQluehd

Solution

Show

Once again this is a pretty straight forward solution, though it may take a little time reading through the man page of the openssl command to get the syntax correct. As before we want to pipe the password from /etc/bandit_pass/bandit15 to the connection command. To connect we want to use openssl (openssl) as a client (s_client) to connect (-connect) to the localhost on port 30001 (localhost:30001). However when doing just that we run in to the problem that was warned about on the OTW page, so we must add the -quiet flag. I’ll be honest, I have not researched what exactly that does, and it is not in the man page, but since OTW explicitly advised us to try it, I figured I would and it worked. You will see the password appear just over the line reading “read:errno=0”

[$]-> cat /etc/bandit_pass/bandit15 | openssl s_client -connect localhost:30001 -quiet

The password for bandit16 is: cluFn7wTiGryunymYOu4RcffSxQluehd

6 thoughts on “Bandit Walkthrough – Level 15”

Hey buddy – correction:
[$]-> cat /etc/bandit_pass/bandit15 | openssl s_client -connect localhost:30001 -quiet

Josh says

August 26, 2015 at 1:54 pm

Good catch! Thanks!

Reply

So, from what I have tried, if you simply copy and paste the bandit15 password, while using the command

openssl s_client -connect localhost:30001

You will not only receive a lot of information you don’t need (certificate and session information), but you will be able to then paste the password and get the result you need. If you use the command

cat /etc/bandit_pass/bandit15 | openssl s_client -connect localhost:30001

for some reason you won’t receive a message with the next password. However by tacking on -ign_eof, you will still receive the certificate and session information, but you will also receive the password you need. -ign_eof is implicitly turned on by using -quiet. -quiet merely removes all the certificate and session information, so the real question here is why -ign_eof is needed when piping.

Let me know if you have any idea.

Tarq says

February 19, 2017 at 2:55 pm

We dont have access to the password with #cat /etc/bandit_pass/bandit15 so we cant pipe as far as i can get it to work. Copy paste seems like the only solution

Reply

the -quiet is an s_client argument

james says

March 21, 2017 at 3:58 pm

and it means that you get no s_client output

Reply

Kerberized: A Mac Administration and General Security Blog

Bandit Walkthrough – Level 15

Level Description

Hint

6 thoughts on “Bandit Walkthrough – Level 15”

Leave a comment Cancel reply