[ Docker ] Bandit Wargame 만들기 - 29번 문제 ( 30 / 33 )

1. Bandit29 목표

There is a git repository at ssh://bandit29-git@localhost/home/bandit29-git/repo via the port 2220.
The password for the user bandit29-git is the same as for the user bandit29.

Commands you may need to solve this level
git

 

2. Bandit29 구현

# 비밀번호 root 입력 접속
ssh -oStrictHostKeyChecking=no root@localhost -p 2220

useradd bandit30 && echo -e "qp30ex3VLz5MDG1n91YowTv4Q8l7CDZL\nqp30ex3VLz5MDG1n91YowTv4Q8l7CDZL" | passwd bandit30

chmod 755 /home/bandit30

chown root:root /home/bandit30

chown -R root:root /home/bandit30/.[!.]*

echo qp30ex3VLz5MDG1n91YowTv4Q8l7CDZL > /etc/bandit_pass/bandit30

chown bandit30:bandit30 /etc/bandit_pass/bandit30

chmod 400 /etc/bandit_pass/bandit30

useradd bandit29-git && echo -e "4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7\n4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7" | passwd bandit29-git

chmod 750 /home/bandit29-git

mkdir -p /home/bandit29-git/repo

chmod 775 /home/bandit29-git/repo

git init --bare /home/bandit29-git/repo

chown -R bandit29-git:bandit29-git /home/bandit29-git/repo

chsh -s /usr/bin/git-shell bandit29-git

TMP_DIR=$(mktemp -d)

cd $TMP_DIR

# 4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7
# 패스워드 입력
GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git clone ssh://bandit29-git@localhost:2220/home/bandit29-git/repo

cd $TMP_DIR/repo

cat <<'README' > $TMP_DIR/repo/README.md
# Bandit Notes
Some notes for bandit30 of bandit.

## credentials

- username: bandit29
- password: <no passwords in production!>

README

chmod 664 $TMP_DIR/repo/README.md

chown bandit29:bandit29 $TMP_DIR/repo/README.md

git config user.email "noone@overthewire.org"

git config user.name "Ben Dover"

git add $TMP_DIR/repo/README.md

git commit -m "initial commit of README.md"

sed -i 's/bandit29/bandit30/' $TMP_DIR/repo/README.md

git add $TMP_DIR/repo/README.md

git commit -m "fix username"

git switch -c sploits-dev

mkdir $TMP_DIR/repo/exploits

cat <<'BANDIT_FILE' > $TMP_DIR/repo/exploits/horde5.md

BANDIT_FILE

git config user.email "morla@overthewire.org"

git config user.name "Morla Porlar"

git add $TMP_DIR/repo/exploits/horde5.md

git commit -m "add some silly exploit, just for shit and giggles"

git checkout master

git switch -c dev

mkdir $TMP_DIR/repo/code

cat <<'BANDIT_FILE' > $TMP_DIR/repo/code/gif2ascii.py

BANDIT_FILE

git add $TMP_DIR/repo/code/gif2ascii.py

git config user.email "noone@overthewire.org"

git config user.name "Ben Dover"

git commit -m "add gif2ascii"

cat <<'README' > $TMP_DIR/repo/README.md
# Bandit Notes
Some notes for bandit30 of bandit.

## credentials

- username: bandit30
- password: qp30ex3VLz5MDG1n91YowTv4Q8l7CDZL

README

git add $TMP_DIR/repo/README.md

git config user.email "morla@overthewire.org"

git config user.name "Morla Porlar"

git commit -m "add data needed for development"

git checkout master

# 4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7
# 패스워드 입력
GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git push --all

 

3. Bandit29 문제풀의

# bandit29 로 설정한 패스워드를 입력하여 접속한다.
# 4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7
ssh -oStrictHostKeyChecking=no bandit29@localhost -p 2220

TMP_DIR=$(mktemp -d)

cd $TMP_DIR

# 4pT1t5DENaYuqnqvadYs1oE4QLCdjmJ7
# 패스워드 입력
GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git clone ssh://bandit29-git@localhost:2220/home/bandit29-git/repo .

# 모든 브랜치 확인
git show-branch --all

# 패스워드 확인
git log --all -p -- $TMP_DIR/README.md | grep password | awk '{if (length($3) == 32) print $3}' | uniq