ctf_aria

write up ctf by ariafatah

Project maintained by ariafatah0711 Hosted on GitHub Pages — Theme by mattgraham

soal

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

NOTE: Looking at shell scripts written by other people is a very useful skill. The script for this level is intentionally made easy to read.
If you are having problems understanding what it does, try executing it to see the debug information it prints.

ssh

sshpass -p "tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q" ssh -o StrictHostKeyChecking=no bandit22@bandit.labs.overthewire.org -p 2220

solve

check cronjob file

cd /etc/cron.d
cat cronjob_bandit23
# @reboot bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
# * * * * * bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null

cat /usr/bin/cronjob_bandit23.sh

#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget

try running the file for debuging

/usr/bin/cronjob_bandit23.sh
# Copying passwordfile /etc/bandit_pass/bandit22 to /tmp/8169b67bd894ddbb4412f91573b38db3

cat /tmp/8169b67bd894ddbb4412f91573b38db3
# tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q

## but after i try the flag is not the password for bandit23

modification the file

## try running with the modification file
workdir=$(mktemp -d); cd $workdir
cp /usr/bin/cronjob_bandit23.sh .

cat ./cronjob_bandit23.sh
######
#!/bin/bash

myname="bandit23" # change the value
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

# cat /etc/bandit_pass/$myname > /tmp/$mytarget
######

./cronjob_bandit23.sh
# Copying passwordfile /etc/bandit_pass/bandit23 to /tmp/8ca319486bfbbc3663ea0fbe81326349

cat /tmp/8ca319486bfbbc3663ea0fbe81326349
# 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga

flag

0Zf11ioIjMVN551jX3CmStKLYqjk54Ga