Bandit 16 → 17

OverTheWire

Linux Progressive

Goal: find which port in 31000 to 32000 returns a credential for the current password, then use what it returns to log in as bandit17.

Approach

Scan the range to identify open ports and determine which speak SSL, then transmit the password to the TLS port that behaves as something other than a plain echo server. It replies with an RSA private key instead of a standard password string. Save this text block as a local file, restrict its permissions to mode 600, and use it to log in as the next user.

bandit16@bandit:~$ nmap -p 31000-32000 --open -sV localhost
PORT      STATE SERVICE     VERSION
31046/tcp open  echo
31518/tcp open  ssl/echo
31691/tcp open  echo
31790/tcp open  ssl/unknown
31960/tcp open  echo
bandit16@bandit:~$ openssl s_client -connect localhost:31790 -quiet
<password>
Correct!
-----BEGIN RSA PRIVATE KEY-----
... (key returned, revealed below) ...
-----END RSA PRIVATE KEY-----

bandit16@bandit:~$ cd "$(mktemp -d)"
bandit16@bandit:/tmp/tmp.zDtZtyb689$ vim key.private        # paste the key
bandit16@bandit:/tmp/tmp.zDtZtyb689$ chmod 600 key.private
bandit16@bandit:/tmp/tmp.zDtZtyb689$ ssh -i key.private bandit17@bandit.labs.overthewire.org -p 2220

Reveal private key

-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
... (key truncated; the SSL service returns the full PEM on the box) ...
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

Why it works

Service discovery maps each port to a protocol (nmap -sV), so you know which ones need TLS (ssl/…) versus plain echo before you connect. The two ssl ports are the candidates, and the one that is not a plain echo returns the credential. The reward is a private key, so authentication moves from something you know (a password) to something you have (a key), which is why ssh refuses it until it is saved with mode 600.

Full session log

bandit16@bandit:~$ nmap -p 31000-32000 --open -sV localhost
Starting Nmap 7.94SVN ( https://nmap.org )
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00011s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT      STATE SERVICE     VERSION
31046/tcp open  echo
31518/tcp open  ssl/echo
31691/tcp open  echo
31790/tcp open  ssl/unknown
31960/tcp open  echo
1 service unrecognized despite returning data. If you know the service/version, please submit
the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31790-TCP:V=7.94SVN%T=SSL%I=7%D=8/9%Time=6896B874%P=x86_64-pc-linux
SF:-gnu%r(GenericLines,32,"Wrong!\x20Please\x20enter\x20the\x20correct\x20
SF:current\x20password\.\n")%r(GetRequest,32,"Wrong!\x20Please\x20enter\x2
SF:0the\x20correct\x20current\x20password\.\n");
Nmap done: 1 IP address (1 host up) scanned in 162.59 seconds
bandit16@bandit:~$ openssl s_client -connect localhost:31790 -quiet
depth=0 CN = SnakeOil
verify error:num=18:self-signed certificate
<password>
Correct!
-----BEGIN RSA PRIVATE KEY-----
... (key returned, revealed below) ...
-----END RSA PRIVATE KEY-----