Bandit Walkthrough – Level 16

Level Description

http://www.overthewire.org/wargames/bandit/bandit17.shtml

Now we are starting to get in to the juicy stuff! This level is designed to make you scan for open ports, identify the services on those ports, then connect securely to the only applicable port in the same manner as the last level.

Hint

This level has 3 stages, in the first one you will use nmap to scan for and identify ports. In the second one you will follow the same exact process to connect as the last level. In the third stage you will need to create your own private key to connect to the next level. This level may take some trial and error, but stick with it – the errors are pretty self explanatory and if you have patience you should be able to get through it in a reasonable amount of time. If you are interested in security work, make sure to learn all you can about nmap – it will almost certainly be one of the most used tools in your toolbox!

Solution	Select Show
A little reading of the nmap man page should give you a pretty good idea of the syntax needed to scan and identify ports. One strange thing I noticed about this level is that nmap does not seem able to identify which port is running SSL, even though it does have scripts to do so. As such you will have to try each port until you come up with the one that response correctly. Once you have passed the password to the proper port you will be rewarded with a giant block of text which is an RSA Private Key. You will need to take this key and paste it into a file (sshkey.private for example). If you were to try to connect using the key in this state you would get a warning and the server would reject it. This is because ssh checks the permissions on the key, and if the write permissions are too broad it will reject the key. As such we need to limit the access by changing the permissions to 600. Once you have done that you can connect to bandit17@localhost using your ssh private key. [$]-> nmap -sV -vv -p 31000-32000 localhost [$]-> cat /etc/bandit_pass/bandit16 \| openssl s_client -connect localhost:31790 -quiet [$]-> mkdir /tmp/mykey [$]-> nano /tmp/mykey/sshkey.pem ## PASTE IN THE PRIVATE KEY THEN SAVE AND EXIT [$]-> chmod 600 /tmp/mykey/sshkey.pem [$]-> ssh -i /tmp/mykey/sshkey.pem bandit17@localhost The password for bandit17 is: -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama +TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT 8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM 77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3 vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY= -----END RSA PRIVATE KEY-----

Solution

Show

A little reading of the nmap man page should give you a pretty good idea of the syntax needed to scan and identify ports. One strange thing I noticed about this level is that nmap does not seem able to identify which port is running SSL, even though it does have scripts to do so. As such you will have to try each port until you come up with the one that response correctly.

Once you have passed the password to the proper port you will be rewarded with a giant block of text which is an RSA Private Key. You will need to take this key and paste it into a file (sshkey.private for example). If you were to try to connect using the key in this state you would get a warning and the server would reject it. This is because ssh checks the permissions on the key, and if the write permissions are too broad it will reject the key. As such we need to limit the access by changing the permissions to 600. Once you have done that you can connect to bandit17@localhost using your ssh private key.

[$]-> nmap -sV -vv -p 31000-32000 localhost
[$]-> cat /etc/bandit_pass/bandit16 | openssl s_client -connect localhost:31790 -quiet
[$]-> mkdir /tmp/mykey
[$]-> nano /tmp/mykey/sshkey.pem

## PASTE IN THE PRIVATE KEY THEN SAVE AND EXIT

[$]-> chmod 600 /tmp/mykey/sshkey.pem
[$]-> ssh -i /tmp/mykey/sshkey.pem bandit17@localhost

The password for bandit17 is:

20 thoughts on “Bandit Walkthrough – Level 16”

alex says

February 2, 2016 at 10:15 pm

When I try and log in to bandit17 it keeps asking me for a passphrase. i already did ‘chmod 600’ to my private key. I’ve tried at least 5 times and it keeps asking for a passphrase for the key. why?

Reply
- fedemengo says
  
  March 23, 2016 at 5:57 am
  
  Use:
  nano /tmp/mykey/sshkey.pem
  instead of:
  nano /tmp/mykey/sshkey.private
  
  Reply
  - Josh says
    
    March 23, 2016 at 8:19 am
    
    Fixed – thanks for the correction!
    
    Reply
  - Mykel says
    
    July 22, 2017 at 12:53 am
    
    I used “nano /tmp/mykey/sshkey.private” but its still asking for passkey
    
    Reply
    - Mykel says
      
      July 22, 2017 at 12:55 am
      
      It’s also telling me that nano is not a command
      
      Reply
- Timo says
  
  May 27, 2016 at 4:56 pm
  
  I guess you have solved the issue in the meantime, but an answer is still valuable for people:
  
  You need to include the
  —–BEGIN RSA PRIVATE KEY—–
  and
  —–END RSA PRIVATE KEY—–
  lines in your private key file.
  
  That al least was my mistake, now the passphrase question is gone.
  
  Cheers!
  
  Reply
MoHSeN says

April 22, 2016 at 5:13 pm

Hi,
I entered:
nano /tmp/ (deleted) /sshkey.pem
Then pasted RSA, But I cant save the file.
[ Error writing /tmp/ (deleted) /sshkey.pem: Permission denied ]
Thank you.

Reply
- MoHSeN says
  
  April 22, 2016 at 5:21 pm
  
  I logged in by bandit12 and then saved the key file.
  So by using it I logged in to bandit17.
  Is this the only solution for saving the file to temp directory?
  
  Reply
  - Josh says
    
    May 3, 2016 at 4:03 pm
    
    As far as I know, though to be honest it has been years since I did any of these. You may be able to create a different temp directory and use that instead. It is entirely possible they have changed the process since then.
    
    EDIT: You can also create this file locally (on your own system) and SSH from there.
    
    Reply
Allen says

August 31, 2016 at 10:58 am

Whenever I get through the commands and save everything, it always asks me for bandit17@localhost’s password and does not let me log into bandit17. Why is it asking me for a password even though I already sent it a key?

Reply
- Josh says
  
  October 7, 2016 at 2:09 pm
  
  This is my fault, I made an edit to the page a while ago, but forgot to change all instances. Make sure you use sshkey.pem rather than sshkey.private.
  
  Reply
  - Sam says
    
    December 31, 2016 at 1:47 pm
    
    I have used sshkey.pem but it still asks me for the password and the passphrase for the key
    
    Reply
    - Sam says
      
      December 31, 2016 at 2:14 pm
      
      Oh never mind I figured out what I did wrong. Just wondering for the sake of knowledge, why do you have to use pem instead of private?
      
      Reply
Austin says

December 14, 2016 at 5:00 pm

How did you know that the proper SSL key was in /etc/bandit_pass/bandit16? ~/bandit16 has a “snakeoil” ssh key, so it is understandable that it is not to be trusted.

Thanks!

Reply
jack says

March 25, 2017 at 5:23 pm

why do i have to use .pem? ]it keeps asking me for password even after changing the name to sshkey.pem, what should i do?

Reply
- Dave says
  
  March 5, 2018 at 9:32 pm
  
  Don’t forget to add -p 2220 when ssh from your account
  
  Reply
Bjamse says

August 20, 2017 at 6:22 am

hey! i tried to do as everyone else but i met a few problems.
– server didnt have nano (solved, used vim)
– server on bandit 17 started asking “Enter passphrase for key ‘key.private’: ” when i connected using the private key

solution to *
make a file on my Desktop using nano named sshkey.pem with private key inside and connect using :
ssh -i ~/Desktop/sshkey.pem bandit17@bandit.labs.overthewire.org -p 2220

Reply
- Bjamse says
  
  August 20, 2017 at 6:25 am
  
  EDIT:
  Also tried to use sshkey.pem as key on server and didnt work either
  
  Reply
Damo says

August 26, 2017 at 5:23 pm

Using –version-all flag on -sV will tell you that it is an ssl service. The scan takes some time though, so identify the ports you’re interested in first using : nmap -sV localhost -p 31000-32000 which will return :
PORT STATE SERVICE VERSION
31046/tcp open echo
31518/tcp open msdtc Microsoft Distributed Transaction Coordinator (error)
31691/tcp open echo
31790/tcp open msdtc Microsoft Distributed Transaction Coordinator (error)
31960/tcp open echo

bandit16@bandit:~$ nmap -sV –version-all -vv localhost -p 31790

Reply
Alex says

December 24, 2017 at 6:07 pm

Make sure there are 5 -‘s before & after BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY.

As of 12/24/17 the top line has 6 each and the bottom has 5.

Reply

Kerberized: A Mac Administration and General Security Blog

Bandit Walkthrough – Level 16

Level Description

Hint

20 thoughts on “Bandit Walkthrough – Level 16”

Leave a Reply to Josh Cancel reply