CTF Lab

Level Goal The password for the next level is stored somewhere on the server and has all of the following properties: owned by user bandit7 owned by group bandit6 33 bytes in size 1. Since this level was similar to the previous one, I tried applying the same conditions (find / -user bandit7 -group bandit6 -size 33c), but got way too many errors. 2. Added 2>/dev/null to suppress the errors - and the result came up right away. 3. Found the file at /var/lib/dpkg/info/bandit7.password. 4. Got the password.Yarrrr

Level Goal The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties: human-readable 1033 bytes in size not executable 1. Running ls revealed a huge number of directories. 2. Seeing find listed under "Commands you may need to solve this level" made it pretty obvious that was the way to go - it's a command used to search for files matching specific conditions. 3. Anyway, applying the given conditions as options: -size 1033c -not -executable One file showed up right away. Yar

Level Goal The password for the next level is stored in the only human-readable file in the inhere directory. 1. Since the target file was said to be in the inhere directory, I navigated into it using cd and then ran ls to check the list of files. 2. Looking at the file keyword under "Commands you may need to solve this level", files can be broadly categorized into two types: ASCII text, which includes plain text and source code that humans can read, and data, which includes binary files, images, and executables that are not human-readable. Using the file command to check each file revealed three types: ASCII text, Non-ISO extended-ASCII text, and data. data → Binary format, not human-readable Non-ISO extended-ASCII text → Contains special characters that may appear garbled ASCII text → Fully human-readable 3. The answer appeared to be in -file07, but I checked -file05 first just to verify - and as expected, the text was garbled. The answer was in -file07.

Level Goal The password for the next level is stored in a hidden file in the inhere directory. 1. Since the problem states there is a hidden file inside the inhere directory, I navigated into it using the cd command. Running ls showed nothing - it really was hidden. 2. Looking through the options for the ls command listed under "Commands you may need to solve this level", I found that the -a option does not ignore entries starting with .. I tried it immediately. 3. Discovered a hidden file named ...Hiding-From-You. Found it.

Level Goal The password for the next level is stored in a file called --spaces in this filename-- located in the home directory 1. Used ls to confirm the filename spaces in this filename. Applying what was learned in Lv.1 → Lv.2, I tried cat ./spaces in this filename, but the shell recognized ./spaces, in, this, and filename as separate files. 2. This appeared to be caused by the spaces in the filename. I looked up Google Search for "spaces in filename" from the Helpful Reading Material section, which explained that filenames containing spaces are treated as separate files by the shell, resulting in the error shown in the first image. The solution is to either wrap the filename in quotes or use an escape character (\) before each space.

Level Goal The password for the next level is stored in a file called - located in the home directory Connected to lv.Connected to lv.1 using the password obtained from lv.0 → lv.1. 1. Tried the same approach - used ls to check the filename and cat to read the file contents. However, only a cursor appeared instead of the file contents, so I used ls -l to inspect the file in detail. 2. The -l option stands for "long" and displays files in a long listing format, showing detailed information about each file. From the ls -l output, the user with uid bandit2 has read (r) and write (w) permissions, the user with gid bandit1 has read (r) permission only, and others have no permissions. Since I'm currently logged in as bandit1, I do have read access. I then Googled "dashed filename" from the Helpful Reading Material section. According to the search results, filenames starting with a dash (-) are valid in Linux, but since Unix command options also start with a dash (-), the shell interprets the filename as a command option - which is why only a cursor appears (waiting for standard input). 3. Therefore, when working with a dashed filename, you must specify the full path to the file explicitly. This leads to the solution.

Level Goal The password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game. 1. In Linux, the ls command stands for "list" and is used to display the contents of the current directory or a specified path. Usage: ls [options] [file or directory] 2. The cat command is a basic Linux command used to display the contents of a text file on the screen. Usage: cat [options] [file]