Hi, within this lecture, we're going to continue over over the Warrior Challenge Bandits, level 19,
now we have Bendit 20 that should do over here.
So this is an executable.
And if we just surround the file bandit and you do, we can see that this is an executable.
Indeed.
And there is a great hint on the right hand side which says that this is a sacred binary, which means
that we get to run this in an escalated privileged fashion.
So let me show you what I mean.
It says that the password for this level can be found in the usual place.
So remember, we have this password in the ETSI Bendit Pass.
So if we run this cat at Suspended Pass and Bendit 19, then we can get the password for the 19.
But if you run this Fassbender 20, then we cannot get this right because only Bandit 20 can cut this
out.
But if we run this bandit, we need to do OK.
So this is a file that we can run as another user and in this case it's Bendit to any.
OK, if you run this regularly, it will say that the running comment is another user.
So this is what setted does actually we're going to deep dive into a sewage in the following sections.
So right now I'm going to run it and you will see that Umbanda 2019.
But if I run this Bandha 20 do ID now, you will see that my stupid's Bendit 20 so we can use this Bendit
when you do to run comments as if we are Bendit 20.
OK, and it means that we can easily cut out the Bendit Pass for the band at twenty.
So all we got to do is just around then the 20 do Chad and Etsi Bendit pass benefits and Bendat 20.
And here you go.
We got back the password for the band The Twenty.
Now I'm going to copy this and save it to my password Texte and if you don't know how to use a squid's
we're going to deep dive into them, especially in the privileged escalation sections.
Not no worries.
They are temporary permissions and we can run as commands as if we are like escalated privilege fashion.
OK, so I'm going to go into the band to train you right now and I'm just going to test to see if we
got the right password or not.
So here you go.
We are inside of Band of Twenty, which means that we got the right password.
So I'm going to go to the next level, which is to level twenty one.
So this is about stupid's one more time.
So let's see.
Situated binary in the home directory that does the following.
It makes a connection to localhost on the port.
You specify as a command line argument.
OK, so it then reads a line of text from the collection and compares it to the password in the previous
level, then the twenty.
If the password is correct, it will transmit the password for the next level.
Yep.
So we're going to give the band the training password and it will give us the band, the twenty one
password and.
Yep.
Great.
So let me try this then again, since this is about acid's, it will give us some kind of like an escalated
privilege and we will take leverage of that.
And again, this is a legitimate privilege escalation technique so that we're going to see those a lot
in the following sections.
But for right now, we're just practicing it.
OK, so let me just take the level to any password over here, OK?
We have that.
So let me see what we have here in the bend.
The twenty.
So there should be a file, OK?
Yep.
Here you go.
As you connect.
So when we run this as you connect, um, let's see what it asks us.
This program will connect to you in part on localhost using TCP.
Great.
If it receives the correct password from the other side, the next password is transmitted back.
So this is kind of tricky.
It doesn't ask us to give the password to this part.
OK, so we cannot do that.
I believe it asks us to transmit the password from another to another terminal or another connection,
something like that.
So let me try to run and then map.
To see the open ports over here in our local host, and I believe we have to find the TCP port to transmit
that information, so we have DSH.
Yep, here you go.
We have DSH.
Obviously, we have some kind of different things over there.
And I believe we have seen this 30000.
We have used them in the previous challenges.
Right.
We have the Seek's thousands over here.
Maybe we can do something with those.
I don't know.
We have this 113 ident.
Let's try either of these like sixty ten.
OK, did it connect.
Let's try to copy and paste some stuff.
Let's see if this works or not.
Let's come over here.
Let's face this and let's see the enter.
It doesn't do anything right.
So maybe we can try with the other ports here as well.
But again, I believe it's looking for something else.
So let me try to connect like something like 444 for which is which doesn't exist here anyway.
Maybe we can create a port over here by just running that's cat or cat and we can try to connect back
to that port from another terminal.
Which makes sense to you.
Right, because let's try that net cat.
Listen, four four four four eight will just try listening, start listening.
And if I just, um, connect to the 20 from another terminal over here, OK, and give the password
over there.
Let's do that.
Let's come over here.
Just open another session in another terminal.
OK, now I have to say for twenty twenty.
Now let me try this one more time.
If you connect four four four four.
Yeah.
It says that it couldn't connect.
Let me come back over here.
As you can see we're listening or there.
So this port should be opened but I cannot connect it for some reason.
Maybe we should specify the localhost and ports explicitly, OK, and try like that because we don't
know how DSU connect things works.
OK, that's an executable.
I believe we have to just specify the port that we are trying to connect to.
But again, this way we will be much more certain.
So I'm going to say localhost MP for four four and over there I'm just going to try it one more time.
And here you go.
I believe this work now, so make sure you're on the same command like that.
And I'm going to copy and paste the thing over here one more time because we are instructed to do that.
Right?
So give the password to any vendor to any and receive the password to anyone.
Yeah, here you go.
Now, it worked.
I believe we got the thing here and the from the other terminal as well.
So great.
I'm going to copy and paste this thing.
Let me see which one.
We're going to get that there.
The same I believe.
So I'm going to copy this one and here you go.
Now let me try one more time.
I'm going to go with this one if I can.
Yeah, here you go.
Now I'm going to exit out of this one and just try to connect to the the twenty one.
So let's try this and see if this works or not.
So I believe this was a little bit different, right?
It's a little bit interesting.
We already knew how to work with that cat.
And again, it doesn't work for some reason.
Let me try one more time.
Maybe I couldn't copy even though I tried hard.
So let me try one more time.
And as I was saying, it was a little bit interesting in the section.
However, we have learned something, I believe.
So it's good to go now.
We are inside of Bandha twenty one and don't forget to Neno here and just save your password so that
you can keep a good log.
So I'm going to stop here and continue with the level twenty one within the next lecture.