Hi, we are currently independent 15 and we want to go to Bendit, level 16, so I'm going to open the
tips for the level 16 and let's see what we have here.
So the password for the next level can be retrieved by submitting the password of the current level
to port thirty thousand and one on localhost using SSL encryption.
So this seems to be some kind of the same thing that we did previously.
However, this time we're going to have to use SSL encryption and over here we have an open SSL is a
tip.
So let me check the help of this open SSL and I believe we don't have open SSL help over here.
So let me just say open SSL dash h and yeah, we cannot get that.
Let me try like this man.
Openness is up.
Yeah.
Here you go.
So if you cannot find the documentation you can always run men as in manual.
OK, you can see the manual of the command that you're trying to run.
So here you go.
Let's see how we can transfer any information or send that information to airport over here, OK?
And I haven't used this openness in a while, at least in color Linux.
Let me see if we can easily find the comment that we need in order to send this to.
So here you go.
We have a server over here.
This implements a generic SSL server.
Yeah, I believe that's not the thing that we are looking for.
We generally use openness to sell in order to configure SSL in our Web server.
But over here we need to do something else.
OK, so let me hit queue to quit over here, so let's not waste time over here.
I explicitly remember that we can do this with net cat, so I'm just going to search for SSL net cat
over here and I believe I, I believe I misspelled net Kathy up.
Here you go.
So I'm just going to open one of the things that I'm going to find over here, like connecting to https
with that cat.
Yep.
Here you go.
So let's see if we can find the solution over here.
Yeah, here you go.
We can use the open SSL, I believe like this, but it's it's going to be easier with that cat.
So let me try to find this.
Yeah.
This is also piping into the open SSL and it says that NC doesn't do a HTTPS, but I believe we can
do a https with net cat.
So it's Peiping.
The result to the open SSL here, as you can see, it's trying to connect to that server.
Maybe we can try that, but here you go.
We have Incat, which is kind of neat cat.
Let me see if we have Encanto over here.
So like a map but this is and cat and this is not a map.
Okay, so Incat, Dashty Shapiro, we have a CAT, so let's scan this documentation over here.
It actually says and cat dash dash SSL and here you go.
We can connect or listen with SSL using and cat.
So this is what we need and it's going to be fairly easy.
I won't spare time to learn about openness.
Azal over here rather.
I'm just going to go with Incat, I'm going to say and cat and let me just come over here and see so
it's port thirty thousand and one.
OK, so I'm going to do dash dash SSL and localhost and thirty and 2001.
So let me try to paste the password for the level fifteen.
Let's see if we can get back to level sixteen password.
OK, I'm going to paste this election over here and here you go.
It gives us the password for the level sixteen.
So I'm going to copy this.
I'm gonna neno the password over there and I'm going to paste this and save it.
OK, so here you go.
So let's try this.
Let's see if we can get back from here.
Yep.
Here you go.
Let me just go to Bendit sixteen and try to give the password that we have obtained.
So let's try this.
Yeah, here you go.
Let me just say page selection and hit enter and we are inside of Bendit succeed.
So next let's go to the Bendat seventeen.
So from 16 to 17.
Let's see what we got here.
So credentials.
The next level can be retrieved by submitting the password of the current level.
So here you go again, the same thing.
But this time we are trying to find a port on localhost in the range from 31000 to 32000.
First, find out which of these birds have a server listening on them.
So we don't know of the port yet.
We have to find out some kind of listening ports over here.
And I believe you can understand what kind of thing, what kind of tool that we should use in this case.
So it's basically a map, right?
So why do we use a map in order to find the services and the ports and the servers they're running on
this ports?
So in order to understand if these ports are open or closed.
So basically, we're going to use the end map.
It's very obvious.
And we have the map as a tip in the comment section here as well.
So I'm going to run a map.
Right.
So I believe you're familiar with that.
If you have taken this course and we can just skip the parameters over here, actually just specify
the port range.
And in order to do that, we can use that DP and maybe you have done this before.
Maybe you haven't.
Let me show you.
I'm going to just run it against an localhost, OK?
So we don't have to specify the IP number or something like that.
If we do something like this, dash, dash, it will scan all the ports, but it will be a waste of
time for us because we know the range.
So we know it's going to start from the third to 1000 to 2000.
So we can specify a range rather than scanning all the ports in this case.
And in order to do that, just delete the second dash and give the port range over here like this.
So it will start from thirty one thousand and it will end in thirty two thousand.
And as you can see, we get all these ports.
Actually we have only five ports opening opens over here and they are ready to listen.
I believe all we have to do is to find out which of those SSL and which don't.
And actually we can run some other additional parameters in order to understand that using a map like
Alisson for services and stuff.
But we can just try it and see as well because there's only five.
So I'm going to run the same command that we have run in the previous lecture.
So I'm going to copy the level fifteen over here.
OK, I'm going to copy this.
I'm not level fifteen, the level sixteen.
I'm going to copy this if I can.
Let me just select it one more time and right.
Click and say copy selection.
Come back here and paste it over there.
Let's see.
Here we go.
Yeah.
We don't get back anything I believe.
Let me try other things by control.
See, let me just go for thirty one five eighths based selection.
Yeah.
It did give something back but it's the same thing.
I believe this doesn't work as well.
So I'm going to control Sead of this.
And let's try the third one six nine one and let's paste the password over here and hit enter.
Yeah.
We didn't get anything back so let me try the first one.
So seven nine oh and hit.
Enter the password over here and here you go.
We get something back, it looks like an hour as a key.
So let's see this.
There is only one server that will give the next credentials.
So it didn't give us the password, but it gave us the RSA private key, which is exactly the same thing
that we have done before.
This is a private key.
We can use this in order to connect to the next level.
Right.
So all you got to do is actually copy this thing and create and this is the key for yourselves.
So let's do that.
So the main thing over here is to not omit anything in this key.
So you have to get everything in order to create your key, including this and RSA private key over
here as well.
Right.
So take this from here.
Just from like the end of this should be containing all the dashes and stuff as well.
Begin.
RSA, private key and RSA private key.
So I'm going to go into or you can just created over here as well, like in the banded folder, we don't
have anything besides our password that you see.
All you got to do is just to create a new file called Private Key 17.
OK, and just paste the thing that you have copied and save it by control over enter and control X..
So here you go.
Now you have the private key over here like that private key 17.
I named it 17 because we're going to use it to connect it to the 17th.
So I'm going to CD into the Bendit folder because that's where our private key resides.
Right.
So what I'm going to do, I'm going to run this comment and give the Ibram there like we have done before.
Remember the AI parameter?
So I'm going to just run this.
But rather than just saying Bendat and something like that, let me change it to 17 and give the additional
parameter of AI with our private key over here.
So here you go.
Now if I hit enter, it won't ask me for a password because I have already have supplied the credentials
for that.
So it's asking for a password for some reason.
Yeah.
It says that your permissions zero six four four for private key 17 are to open.
So maybe you know about this stuff.
This is the permission for the file itself.
So if you're on Al-Saleh, as you can see right now, we have the read, write, read and read permissions
over here.
So we're going to dive into that permissions later on.
And I believe you know about this stuff.
I assume you know about this stuff.
But for right now, I'm just going to change it to four four four four mode is going to do that for
us.
So all you got to do is just run S.H. Mold for for for for a private key 17.
This will change the permissions settings for this file over here.
As you can see, it's a read, right?
Execute.
OK.
And right now we have changed that.
So this is not going to be read, write, execute.
This is not even going to be read right.
In this case.
This is only going to be only.
OK, so four four four four does that for us.
And the four stands for the bit that is going to be supplying this logic to our file.
So if I a private key 17 one more time, let's see if we can go into.
Yeah.
It says that connection closed by remote host.
Let me just change it to 400 and only we can run this.
Only we can read this and nobody else.
Let's see if this works or not.
OK, and here you go.
So all you got to do is just around 400 on that.
And if you don't know the logic behind this, don't worry.
We're going to see it later on.
And of course, you can search for these remote commands in Linux in order to gain a broader understanding
in YouTube or in any kind of tutorial online as well.
Anyhow, before we go into the level 18.
Let's see if we can find the comment that we have run before.
Yeah, I have written history because I wanted to find there are decent things are where the passwords
are saved on the server.
I couldn't remember that.
I remember we have found some passwords on the Etsy folder before, so I want to get the password for
the Bendit 17 as well, rather than only the private key, because we are keeping a log in our own CTF
folder and we may need that again.
So I'm going to try this right now.
So I believe it was Bendit Pass.
Yeah, here you go.
So Cat at Bendit Pass and this time we're going to go for Bendit 14, not 14.
We have gone for Bendit 14.
But right now we're going to go for Bendit 17.
So the logic is this is saved under the Bendit folder, Bendit Pass filter under ETSI, but only if
you're logged in.
You can read it.
So we have got the password for the level 17 for from here as well.
Great.
Now it's time to go for level 18.
But we.
Going to do that within the next lecture.