Hi, we are currently in the level 17 of the band, the CDF, now we are going to go into the level
18.
So here we have the level 18 password log over here.
It's important that you log every one of the passwords over here, not only for CTF reasons, but we
can lose the connection any time, as you have may already experienced at this point.
And I believe I have already lost my connection to Bendit 17.
I'm going to just close it down and just join that again later on.
Just for right now, I'm going to focus on the right hand side in order to understand what kind of challenge
we are facing over here.
Then we can go back and a cessation to Bendat 17 one more time.
So there are two files, passwords that all that passwords are not new.
So the password for the next level is in passwords that new actually.
And that password is the only one that has been changed between the passwords that old and passwords
that new.
So it's fairly easy.
The only string that has been altered is our password.
So we're going to have to find that thing.
OK, so let me just open a new terminal over here and its decision to bend at 17 because I had lost
my connection.
So I believe there is kind of a time out.
So maybe if you wait something like two minutes or five minutes before writing stuff or interacting
without interacting with it, it will lose the connection.
But I don't know the logic behind it.
So let me run SLA.
Yeah, I believe I've changed my keyboard settings for some reason.
I'm going to change my keyboard back to the Turkish version so you don't have to do that, obviously.
So I'm going to run Ellerslie.
OK, so here we go.
We have those files over here, passwords that you and passwords that AWALT.
So that's good.
So we have to find the difference between them and there is a very basic command that does that for
us.
So let me just get this password.
As you can see, there are a lot of passwords over here.
It's actually very pretty much the same in the cat passwords that old as well.
There are a lot of hashes, so there is only one difference and we have to find it.
So, of course, you can think different kind of algorithms in order to do that.
But there is one command which is diff, and it's given to us here.
It says for difference and it's exactly what we want.
It takes the difference between two files so you can just run diff, OK, and just write the passwords
out all or passwords that new it will give you the difference between those two files.
It's that easy.
So we have two hashes over here.
One of them is our password.
I don't know which is the which one is that.
But I believe since we have written the new first, the first one should be our password.
So let's go for that one.
Now, of course, if it doesn't work, we can always go for the other one as well.
But right now I'm going to assume that is our password.
So I'm going to save this and I'm just going to save it as levels eighteen.
And I'm going to exit out of this one and I'm going to go into the at eighteen.
And here you go.
Let me just try to connect to the band at eighteen and let me test this and see if this works or not.
And here you go.
I believe it's worked, but we get some error.
No, it says that.
Bye bye.
And yeah, here you go.
We have that tip over here.
So we have that note.
If you have sold this level and see bye bye then trying to log in to Bendit 18.
This is related to the next level.
Bendit nineteen.
OK, so I believe there is some sort of a new challenge.
Let's go to Bendit eighteen.
So the password for the next level is stored in a file.
Read me in the home directory.
Unfortunately someone has modified Bekasi to log you out when you log in with SS H so it's a little
bit tricky.
I think so if we log in Wii's S.H. So there is a file called Benghazi and it's it's configured to log
us out and it's interesting.
So all the comments that we need to solve this level is a sausage and cat.
So it's getting a little bit hard as you can.
You see, and I believe we can overcome this with SNH, OK, since this is the only lead that we have
over here, and in order to do that, we have to use, as I say, parameter as the capability of changing
the shell that we are trying to login to so we can do that with DSH.
OK, but we have to specify some new parameters.
We are just saying log in.
But Bendat 18 to that host in this case.
Right.
And rather than Benghazi, we need to cancel out this Benghazi.
So we need to change to another child rather than Bashar over here.
So let me go to Google dot com and search for it.
I'm going to say yes as a child, as H.
So rather than Bash, of course I'm going to go with the S.H. There are different kind of shows that
we can use when we try to open the section in a terminal.
So choosing the shell that SSA uses, that is exactly what I'm looking for.
And here you go.
It's yeah, it's exactly the same thing that we are asking for.
It's using Basche and we need to change it to something else so we can use change.
S.H. Nope, it's it can be used after we log in, but we cannot even log in.
So here we have something like as as H l and the T flag forces a pseudo trial reallocation.
Yeah.
We can try this T flag and our flag spawns a log in shell so we can use those flags in order to try
and change our shallower there.
So let me just scan these other solutions here a little bit and I believe we don't have anything else.
Let's try this t flag.
So I'm going to give T flag over here, OK?
And I'm going to specify the shell at the end like we have seen in one of the examples.
OK, so let's see.
Where was that example.
Yeah, here you go.
As as h now I'm not going to use as S.H. I'm just going to use the old bean S.H..
Right, so it should work if this T flag works.
So all you got to do is just come to the end of this end.
Right.
Bean S.H. in single quotation marks by the way, a single quotation marks like test.
So if I hit enter it will ask me for the password and let me give the password and let's see if we can
come over here.
Yeah.
Let me just take the password one more time.
Let me get the password to see it.
Didn't even accept the password.
I believe we are doing something wrong over here so let me pasted and hit enter.
Yeah.
It says no such file and directory.
It cannot find the bin S.H. So let me just try it like this.
It will make much more sense.
Slash bin slash as H.
OK, and let me give the password one more time and here you go.
We have the shell I believe so we are inside of the shell.
Where am I on banded.
Eighteen.
So good.
So far so good.
So if I run unless I will see the readme and let's see um let's get the read me and here you go.
We have the file, we have the password for the level nineteen.
So it's very easy to go to the level nineteen from eighteen but it's also not easy to open the level
eighteen.
If you don't know you can change the shell with DSH, right.
Of course it can be found easily like we did with Googling.
But again, it's ahady, I believe.
So we are inside of eighteen now and we have the password for the nineteen.
I believe we are done over here.
So if I didn't see that as a comment in the tips, by the way, it would be very hard for me to understand
that I need to change this.
And also it gives us the Benghazi tip over here.
So it was easy for me to find.
But if I didn't have the Benghazi tip and the NSA tip over there, maybe it would take me much more
longer to figure this out.
So let me try say when the nineteen and for some reason we cannot come over here and let me just copy
that one more time and say pace selection.
And here you go.
We are inside of Bendit 19.
So far, so good.
Let me open the Bendit 19 over there, and now we're going to go into the band level 20, so you're
going inside of a new thing, said Eweida.
OK, I'm going to come over here and just stop this and continue within the next lecture to go into
the band at level 20.