Hi, within this lecture, we're going to continue solving our bandwidth capture to flag questions.
So right now we're in level three and I will go to the level three to level four tips.
So as you can see, it says that the password for the next level is stored in a hidden file.
So here you go.
Now, I believe you know how to do this as well.
So you can just around dash L.A. and here you go.
Now we see the hidden folders and hidden files as well.
Right.
So we can come over here to CD in here and there is nothing over here if we on that list.
But if you're in L.A., then we can see the hidden file over there.
So this is a basic one.
You know how to dash L.A., I suppose.
Of course, getting the password out of this is trivially changes from CAT that that hid.
So here you go.
This is the password for the.
For now, I'm going to exit out of that one.
And I'm just going to say to the bandit fa.
So here you go.
Now, if I hit enter, it will ask me for the password.
Then I can give this password and just login.
So I'll pay selection and enter.
Here you go.
Now we are inside of the bend that far.
So let's go to the next level.
So here we have the password stored in the only human readable file.
Yeah.
Here you go.
Human readable file in the in here directory.
So this is kind of interesting.
Let's see what it means.
Human readable.
So I believe many of those will be not human readable and we will just see the human readable file.
So let's try and see if I run the less naturally I can see the in here folder over here.
Right.
So let me come over here to come in here and run Ellerslie or more time.
And here you go.
We have a lot of files over there.
So some files.
Let me just try this one by one.
And it's only 10 files.
And I believe we can do this quickly.
Maybe we can just run a script or write a script to test this automatically.
But I'm not even going to bother with that because it's only some files.
And as you can see, we cannot run this like that.
We have to say dash, slash, dash.
That's slash dash file zero zero.
So here you go.
This is not human readable.
I believe it was talking about this.
OK, so we cannot read that.
And I believe one of these files will contain a human readable text inside of that.
So I'm going to try this for file one and file two and file three.
And let's try it for five, four, five.
Yep, six and seven.
And here you go.
We have the password for the next level, I believe.
So this should be the password for the Bendit five.
So what I'm going to do, I'm going to copy this, OK?
And I'm going to copy selection and I'm going to exit out of this one and just click connect to Bendit
five.
Let me come over here and write Bendit five.
It will ask me for the password and we will see if we do this right.
So let me pass it over here and enter.
So here we go.
We are inside of Bendit five and let me just open the tip from here as well.
So level five to level six.
Again, we have a password and it start in a file somewhere around there in here directory.
But this time it should be human readable and it has a specific bytes in size and it should not be executable.
Very interesting.
Let's try to find that.
Let's see how it looks like.
Let me run the list.
Here we go.
We have them here folder.
Let me run Ellerslie and we have a lot of folders right now.
Maybe here, maybe there.
So we have twenty folders.
So this time we're not going to try this one by one, I believe.
Right.
So it's getting harder and harder.
I believe if we go into those folders, there will be a lot of many more files inside of those folders
as well.
Let me try one and here you go.
We have a lot of files over here like file one, file spaces, something like that.
So we have to find a way to test this at once.
And actually, we have to find a way to.
Find our file with this specifications with bitts or not executable specifications.
Of course, you can just try to see the size of the file inside of those folders, but it will take
some time.
And here we have the tip.
We have a comment in Linux called Find.
And let me go to a new tab over here.
It runs in color Linux as well.
Obviously, you can see how it's used over here by typing find if you just type find, it will just
try to find every file and folder and it won't do any good for you.
OK, so I'm going to clear this up and I'm going to run find that stack help so that we can see how
it's used.
Let me open this up and here you go.
So find is a comment that we use in order to find some file or folder.
And it has it takes in a lot of parameters over here.
So we have to understand how can we use this in order to specify the site or specify the executable
or not.
So over here you can see the normal options, tests and actions like you can just specify the maximum
depth, minimum depth.
That tab pattern is regex or whole name executable, readable.
You can specify anything you want, actually.
And we're going to use all of those things because as you can see, it says executable, I'd say.
Sighs Yeah, we're definitely going to use sites, right.
Because we have this one thousand thirty three bytes and not executable over here.
We can just specify.
I want to find the files that is 1033 bytes in size, and I want to find the files that are not executable
at all so that I can actually narrow down my search and I can just try maybe a couple of files to see
if they're the ones that I'm looking for.
So we're going to use this comment in the server as well.
So I'm going to make the smaller a little bit one more time.
And let me go back to here and let's try to run the find comment over there, OK?
And we're going to narrow down all the possibilities over here.
But I believe I cannot type anything right now, and I believe I lost my connection somehow.
Maybe we can just exit out of this one or just try to connect it one more time.
Let me see if I can get my password.
By the way, I don't have my password stored over here.
Let me try to pasted over there and let's see if this works or not.
Here you go.
Yeah, I have the password and I just realized that we are not saving this passwords.
And I believe it's a very good habit to save all those passwords, all those passwords into a text file
so that if we lose our connection like that, we can come back and check it.
So let me go to my documents and I'm going to create a folder called CTF or something like that, or
Bendat.
Let's actually call this ETF because we're going to solve a lot of ETFs over here.
I'm going to go into this ETF and I'm going to create Bendit over here and I'm just going to go into
the Bendit and I'm going to create a not static, OK?
I'm going to just use the Nano.
I'm going to call this password and I'm just going to paste is over here.
So this is level five.
OK, so I'm going to take note of all the passwords.
I'm going to say control all control X and here we are.
So here you go.
I believe you know how to use Nano by this time if you don't try to use any other text editor that you're
comfortable with.
OK, I'm going to paste is in and I'm going to try to log into our server over here.
But I believe there is something wrong or let me try one more time.
Here you go.
Yeah, we're getting some kind of a weird error over here.
Let me try to copy this one more time from the file that we have just created.
Maybe I have copied spaces by mistake.
OK, it happens.
So I'm going to cut this out and I'm just going to take this, OK?
And I'm just going to copy this.
And I'm just going to come back over here and I'm going to log into the banded five one more time.
Here you go.
Let me paste this election and hit enter and see what happens.
Let me try one more time.
Here you go.
Um, yeah, it says a connection closed.
So maybe there is something wrong with the server.
I'm going to try this one more time and see if we can make it right or not.
Yeah, here you go.
Now, we made it right.
So I'm going to clear this thing and I'm just going to use the find comment that we have been discussing.
OK, so I'm going to go over here and if we just write, find that, OK.
So that means I'm trying to find something in the current folder and I'm going to specify the type and
size and whatever I want over here.
So for the type I'm going to I'm looking for a file.
OK, so I'm going to specify F and for this size, I'm just going to right size that size.
Obviously I remembered to have documentation and this will be one thousand thirty three.
And let's see if this works or not.
If is, if we don't have any executables over here, we don't need no further filtering.
So here you go.
We only have one file in this current folder that is 1093 bytes in size.
So I believe it was easy to find this.
And of course, we can just narrow it down more.
But there is no point because as you can see, we only have one file and you can just write it like
this.
So executable, as you can see, there is nothing executable over here.
So this is fine.
Anyhow, I found what I'm looking for.
Right.
So you can just write something like this, by the way, in order to make it negative, like find something
that is not executable and all you have to do is just put an exclamation point in front of the executable.
And it gave us the same result because file two is not executable.
So I'm just trying to get this out maybe here 07 and that file, too.
And here you go.
We have the password.
So see how easy this is due to the find comment.
So remember, just find comment because we're going to be using this a lot during the course as well.
So I'm going to try and log into the Bendat six and see if this works or not, see if this is the right
password, if this is the right password.
Don't forget to make a note of it.
Here you go.
Now, this is the right password.
We see.
I'm going to open a new tab and come over here and write it in my password file.
So let's go to Bendit and the Nano password, that taxi.
And I'm going to paste the thing that we have copied over here.
And I'm just going to write Level six.
So control or enter control X and here we are.
So here we go.
Now let's go to the tips for the level six to level seven.
So this is again, defined command, I believe.
So this is the password for the next level will start somewhere on the server and has all of the following
properties.
So either we have a folder called Somewhere on the server or it literally means that it's saved somewhere
on the server.
And we don't know which folder is this.
And it's owned by the user Bendit seven, and it's owned by the group Bendat six.
And it it's only thirty three bytes in size.
So fairly simple because now we know how to use find comment.
Right.
So again without defined comment maybe we couldn't have find this or it would take so much time.
But if you were on display, as you can see, there is no file and folder over here and it literally
means that it's saved somewhere on the server, but we cannot see it.
So we have seen how to use find within the current folder that we are in with the dot com and right.
Finds dot, but we haven't seen how to use find comment for the whole server or for the whole system.
So it's fairly easy.
Again, rather than DOT, you can just write find space slash rather than DOT.
We have written this like that a couple of minutes ago.
Remember, find dot.
Now all we got to do is to replace this with Slash and I'm not even going to do that.
Let's try to run this like that and you will see it won't find anything so.
Write it like this, find that and just specify the type it's going to be a file and the user this time
it's going to be the Bendit seven and the group this time will be Bendat six.
OK, we can specify the size.
Obviously we can just write thirty three over here.
OK, so the, the size of our file that we were looking for is thirty three bytes and here you go.
It couldn't find anything because it really doesn't reside on this current folder.
Now let me replace this dot with Slash and see what happens.
So if you run this like that then it will find a lot of things and here you go.
We have a lot of things but we have permission denied for many of them because it's the user to write
the user.
Bendat Seven owns them and we don't have permission to read them.
And I believe we will find something that we have permission to read.
And here you go.
This is VAR Lip, the packaging for Bendit seven the password.
Here you go.
Now this is the thing that we are looking for.
We're authorized to read this.
As you can see, we don't see permission denied.
Right next to it is.
It's owned by our group but it's owned by the user.
Bendit seven and then seven apparently made it available for us.
So I'm going to check this out and see the password of the Bendit seven.
Here you go.
This is the password of the Bendit seven.
Now, I'm going to copy this and I'm going to make a note of it.
As usual.
I suggest you do the same thing as well so that if you lose your connection at some point, you can
come back and start where you're left off.
Otherwise, it means that you're going to either start from scratch or try to just copy and paste it
from or just try to make a note of it from my videos.
It's hard as well, right?
So let's try to assess each into this at seven.
And I'm going to paste this election over here.
And here you go.
We are inside of the Bendit seven.
Now, what we're going to do, we're going to try to go into the band.
That's eight, of course, and let's do that within the next lecture, because we made this video a
little bit longer.
Let's see you in the next lecture.