1
00:00:00,570 --> 00:00:01,010
Hi.

2
00:00:01,620 --> 00:00:08,400
Currently, we are in Banda 21, and if you're on that list, as you can see, there is nothing here.

3
00:00:08,400 --> 00:00:13,520
So we want to go to 22 and I'm going to open the tips for that.

4
00:00:14,190 --> 00:00:15,500
So here you go.

5
00:00:15,540 --> 00:00:23,490
It says that the program is running automatically at regular intervals from Chrom, the time based job

6
00:00:23,490 --> 00:00:24,280
scheduler.

7
00:00:24,630 --> 00:00:33,390
So if you have never heard about Chrom before Tinkham as like a background service that is running over

8
00:00:33,390 --> 00:00:35,820
there in a given period of time.

9
00:00:36,360 --> 00:00:43,860
So we have to look into it, see Kirundi in order to see the configuration for that Chron and see what

10
00:00:43,860 --> 00:00:44,550
it does.

11
00:00:45,180 --> 00:00:53,760
So basically, if you want callisthenics or any other Linux versions to run a background jump that does

12
00:00:53,760 --> 00:00:59,700
something in a given period of time, then you should actually have a current job.

13
00:01:00,090 --> 00:01:03,110
This is exactly what this so let me show you.

14
00:01:03,120 --> 00:01:08,700
I'm going to go into KDDI at Sea Kirundi, as it's instructed over here.

15
00:01:08,850 --> 00:01:13,500
If you're on Al-Saleh, you can see that we have some crohn jobs.

16
00:01:13,500 --> 00:01:18,050
So these are all jobs that run in a certain period of time.

17
00:01:18,060 --> 00:01:23,970
We don't know whether it's running like every day or every hour, every minute.

18
00:01:24,130 --> 00:01:25,460
We don't know that yet.

19
00:01:25,800 --> 00:01:32,200
We're going to see what they do and we will try to get a password for the next level from them.

20
00:01:32,880 --> 00:01:38,940
So over here, it says that you look at the configuration and see what it does show.

21
00:01:38,940 --> 00:01:41,000
I'm going to try and get this distance.

22
00:01:41,430 --> 00:01:45,470
So I'm going to catch the first one, which has been the 15 route.

23
00:01:45,720 --> 00:01:55,020
And as you can see, it's owned by the route and it's actually running this as H and it's saving the

24
00:01:55,020 --> 00:01:57,780
output into there now, which is nothing.

25
00:01:57,960 --> 00:02:06,030
OK, so it's actually erasing getting rid of the output, but it's actually running this S.H. file.

26
00:02:06,420 --> 00:02:12,870
So maybe if we can find DSH file this Besch script, we can get a lead over there.

27
00:02:13,230 --> 00:02:19,290
However, we're trying to go into Bendit 22, so I'm going to get that one as well.

28
00:02:19,470 --> 00:02:22,390
And as you can see, that that is the same thing, actually.

29
00:02:22,410 --> 00:02:25,320
So this is owned by Bendit 22.

30
00:02:25,740 --> 00:02:29,650
And over here we see Bendat 22, that S.H. as well.

31
00:02:30,030 --> 00:02:31,500
So there's been the twenty two.

32
00:02:31,500 --> 00:02:35,260
S.H. might actually give us the lead that we are looking for.

33
00:02:35,850 --> 00:02:37,270
So Bendit 15.

34
00:02:37,290 --> 00:02:42,780
Maybe it has something to do with the level 15, but we passed that right.

35
00:02:42,790 --> 00:02:45,020
So we don't need that anymore.

36
00:02:45,390 --> 00:02:51,590
So I'm going to focus on this band, the 22 S.H. and see if we can get something out of it.

37
00:02:52,410 --> 00:02:54,330
So Bendit 17.

38
00:02:54,330 --> 00:02:57,620
I believe there was something in the band 17 as well.

39
00:02:58,020 --> 00:03:05,320
But again, we we can just go along and just deal with the other ones from now on.

40
00:03:06,270 --> 00:03:18,990
So let's go and chat this Bendit 20 to MSH user bin Cronje up and then the 22 that H and no such file

41
00:03:18,990 --> 00:03:20,120
or directory.

42
00:03:20,610 --> 00:03:21,510
Yeah, here you go.

43
00:03:21,510 --> 00:03:25,050
I believe I misspelled the Cronje up rather than Cronje up.

44
00:03:25,410 --> 00:03:31,380
I actually have written Bruinooge up, so make sure you get that right.

45
00:03:31,380 --> 00:03:35,070
Right that again and try to just get this out.

46
00:03:36,030 --> 00:03:37,680
So here you go.

47
00:03:37,680 --> 00:03:43,560
Let me just copy it from here or just, just change the beat to see like that.

48
00:03:44,160 --> 00:03:45,080
And here you go.

49
00:03:45,270 --> 00:03:47,280
So this is a bad script.

50
00:03:47,280 --> 00:03:51,780
So this is the Shabangu and it changes something.

51
00:03:51,780 --> 00:03:55,320
It changes a permission of a temporary file.

52
00:03:55,740 --> 00:03:58,560
So as you can see, this is a temporary file.

53
00:03:58,830 --> 00:04:01,500
At least it's in the copy directory.

54
00:04:01,740 --> 00:04:04,500
It changes the permission to six four four.

55
00:04:04,830 --> 00:04:09,150
OK, so we have done that before, as you might remember.

56
00:04:09,540 --> 00:04:16,620
And later on it Katsuta at Seben the password for Bendit twenty two, which is what we are looking for

57
00:04:16,890 --> 00:04:24,510
and also saves the output to that particular file that has been created before.

58
00:04:24,990 --> 00:04:26,730
So it's pretty easy.

59
00:04:26,730 --> 00:04:30,480
I believe it gets the Bendit Pass.

60
00:04:30,780 --> 00:04:35,580
So if we get this temp file over there, just copy and paste it.

61
00:04:35,590 --> 00:04:36,750
You cannot write this.

62
00:04:36,750 --> 00:04:37,620
It's too long.

63
00:04:38,010 --> 00:04:40,590
Let me come over here and paste this election.

64
00:04:40,770 --> 00:04:48,150
We can get the password because it has been read by the band, the twenty two user, and also it has

65
00:04:48,150 --> 00:04:52,890
been saved in the temp directory that that particular file.

66
00:04:52,890 --> 00:04:53,280
Right.

67
00:04:53,700 --> 00:04:59,680
So I'm going to copy this and come over here and then I know my password, the.

68
00:05:00,320 --> 00:05:08,870
And just save it over there, so I'm going to pace this and just ride level 22 like that, so far so

69
00:05:08,870 --> 00:05:09,240
good.

70
00:05:09,260 --> 00:05:18,740
So it actually, as you can see, this was related to grown jobs, but we haven't done so much with

71
00:05:18,740 --> 00:05:19,760
the grown ups yet.

72
00:05:19,910 --> 00:05:26,480
I believe the upcoming lectures will be on Crohn jobs as well, since we have seen Kronur Bandit 23,

73
00:05:26,480 --> 00:05:29,040
24 and 25 over there as well.

74
00:05:29,600 --> 00:05:33,050
So let's see if this is really the case over there.

75
00:05:33,050 --> 00:05:36,440
So I'm going to open the 22 to 23.

76
00:05:37,100 --> 00:05:37,830
Here you go.

77
00:05:38,540 --> 00:05:41,270
So a program is running automatically.

78
00:05:41,300 --> 00:05:42,940
Again, we have a current job.

79
00:05:43,250 --> 00:05:46,750
OK, so it says I look at in at secondees.

80
00:05:47,000 --> 00:05:48,050
So the same thing.

81
00:05:48,050 --> 00:05:51,590
I'm going to go directly into it secondees, OK?

82
00:05:51,860 --> 00:05:53,510
And I'm going to run Al-Saleh.

83
00:05:53,660 --> 00:05:56,120
So we're going to see same things one more time.

84
00:05:56,120 --> 00:06:00,560
But this time I believe we have to focus on Kronur Bandit 23.

85
00:06:01,100 --> 00:06:03,170
So I'm going to catch this thing.

86
00:06:03,170 --> 00:06:04,820
Cronje Up Bandit 23.

87
00:06:05,330 --> 00:06:06,620
And here you go.

88
00:06:06,620 --> 00:06:12,510
We have the best script one more time, so I'm going to get this one and see what it does.

89
00:06:12,560 --> 00:06:16,720
OK, so I'm going to cut and paste selection over here.

90
00:06:17,090 --> 00:06:18,680
So here you go.

91
00:06:18,720 --> 00:06:20,320
An interesting one.

92
00:06:20,660 --> 00:06:22,790
So this is the best script one more time.

93
00:06:22,790 --> 00:06:26,830
It starts with Shabangu and it does something different.

94
00:06:26,870 --> 00:06:30,800
So this particularly stands for the Shabangu.

95
00:06:30,800 --> 00:06:33,110
So it says that this is a bad script.

96
00:06:33,290 --> 00:06:36,800
OK, so even without it, it will be fine.

97
00:06:36,920 --> 00:06:42,700
But we generally place that in order to say that this is a bad script to the users.

98
00:06:42,830 --> 00:06:44,530
So apparently it runs.

99
00:06:44,540 --> 00:06:45,250
Who am I?

100
00:06:45,380 --> 00:06:51,250
And as you can see, if we were on the way, my it gives the current user, which has been the 22,

101
00:06:51,890 --> 00:06:57,820
so it makes my equal to a variable called my name.

102
00:06:58,340 --> 00:07:04,670
So if you know any programming languages, I hope you do at least Python or something like that.

103
00:07:05,270 --> 00:07:07,100
You know what a variable is.

104
00:07:07,130 --> 00:07:11,660
So my name is a variable that holds the value of who am I at this point?

105
00:07:11,900 --> 00:07:15,860
And then my target is Disvalue Echo.

106
00:07:15,890 --> 00:07:17,560
I am user my name.

107
00:07:18,200 --> 00:07:22,270
So Echo means print it out and I am user.

108
00:07:22,280 --> 00:07:32,000
My name is the Wanita at this point and it pipes it to the fivesome later on it cuts said it's formatted

109
00:07:32,030 --> 00:07:36,650
a little bit so maybe you don't know how to work with these commands.

110
00:07:36,650 --> 00:07:38,510
Maybe you haven't worked it before.

111
00:07:39,020 --> 00:07:45,380
But let me just continue for right now and then it echoes the password thingee.

112
00:07:45,380 --> 00:07:51,530
It says that password file Etsi Bendit pass my name to Tempy, my target.

113
00:07:52,130 --> 00:08:02,420
So as you might have understand by now, it actually copies the current user's password to attempt folder

114
00:08:02,420 --> 00:08:06,290
into a file that we don't know yet.

115
00:08:06,710 --> 00:08:12,250
And that file can be inferred from the my target variable.

116
00:08:12,650 --> 00:08:18,410
So if we can calculate the value of the my target's variable, then we can just cut it out, right?

117
00:08:18,830 --> 00:08:28,790
So all we have to do is just understand how to actually calculate is my target and we can do that in

118
00:08:28,790 --> 00:08:29,500
the terminal.

119
00:08:29,510 --> 00:08:37,460
You don't have to know everything about it because we know the my name, my name variable will be equal

120
00:08:37,460 --> 00:08:38,090
to Bendit.

121
00:08:38,090 --> 00:08:38,870
Twenty three.

122
00:08:39,140 --> 00:08:46,070
Remember this will be called by the Bendit twenty three and it couldn't find the command.

123
00:08:46,080 --> 00:08:48,050
So let me just try it like this.

124
00:08:48,500 --> 00:08:50,030
Yeah, it hasn't been defined.

125
00:08:50,090 --> 00:08:52,490
I believe we have to lose the spaces.

126
00:08:52,760 --> 00:08:55,700
You're going to have to write my name Eco's to Bendit.

127
00:08:55,700 --> 00:09:00,770
Twenty three without any spaces like this banded twenty three.

128
00:09:01,640 --> 00:09:02,750
Yep it worked.

129
00:09:02,960 --> 00:09:09,290
So right now if I write another sign my name as you can see dollar sign my name gives me the banded

130
00:09:09,290 --> 00:09:15,050
twenty three right now of course it says that command not font because there is no comment such as bandha

131
00:09:15,060 --> 00:09:15,770
twenty three.

132
00:09:15,920 --> 00:09:20,390
But we managed to assign this to the banded twenty three.

133
00:09:20,750 --> 00:09:29,060
Now if I copied this ok and if I pasted over here then my name is already defined by us.

134
00:09:29,360 --> 00:09:35,870
Now it's going to actually echo this, it's going to actually print this out so that we can see the

135
00:09:35,870 --> 00:09:37,340
value of my target.

136
00:09:37,670 --> 00:09:38,750
And here you go.

137
00:09:38,990 --> 00:09:42,590
This is the value of my target variable.

138
00:09:43,310 --> 00:09:52,370
So I know what is going to be my target and it will copy the current password to the Tempy folder in

139
00:09:52,610 --> 00:09:54,340
that file.

140
00:09:54,380 --> 00:09:55,220
Here you go.

141
00:09:55,220 --> 00:09:59,480
Now we know the file name, so it's kind of a puzzle as you can.

142
00:09:59,490 --> 00:10:06,090
You see, and it's very interesting, so I'm going to cut that out and if I hit enter, here you go.

143
00:10:06,120 --> 00:10:09,270
This is the password for the next level.

144
00:10:09,900 --> 00:10:11,190
So I'm going to copy this.

145
00:10:11,540 --> 00:10:21,210
OK, I'm going to exit out of that one and I'm going to say Gene to 23 and then I'm just going to come

146
00:10:21,210 --> 00:10:25,230
over here, enter and just tried that.

147
00:10:25,680 --> 00:10:28,740
Let me come over here and paste the selection and hit enter.

148
00:10:28,740 --> 00:10:29,600
And here you go.

149
00:10:30,000 --> 00:10:32,150
We are inside of Bendit 23.

150
00:10:32,370 --> 00:10:34,940
I'm going to take a note of that as well.

151
00:10:35,040 --> 00:10:37,860
I'm going to paste over here as a level two and three.

152
00:10:38,820 --> 00:10:39,630
Great.

153
00:10:39,630 --> 00:10:42,780
We managed to make it into the level 23.

154
00:10:43,290 --> 00:10:45,690
We have, I believe, 10 to go.

155
00:10:45,960 --> 00:10:51,330
So I'm going to stop here and continue within the next one with level 24.