[warGame]Bandit Level 6 → Level 7

시작

---

root@goorm:/# ssh bandit6@bandit.labs.overthewire.org -p2220

문제

---

The password for the next level is stored somewhere on the server and has all of the following properties:

owned by user bandit7
owned by group bandit6
33 bytes in size

• user == bandit7
• group == bandit6
• size == 33 bytes

 

해결

---

find / -user bandit7 -group bandit6 -size 33c

• / 는 서버의 최상위 경로. 시스템 전부에서 찾겠다는 옵션.
• -user 옵션은 파일의 소유자를 검색
• -group 옵션은 파일이 속한 그룹을 검색
• -size 옵션은 파일의 사이즈를 검색. c는 bytes를 뜻합니다.

 

find: ‘/root’: Permission denied
find: ‘/home/bandit28-git’: Permission denied
find: ‘/home/bandit30-git’: Permission denied
find: ‘/home/bandit5/inhere’: Permission denied
find: ‘/home/bandit27-git’: Permission denied
find: ‘/home/bandit29-git’: Permission denied
find: ‘/home/bandit31-git’: Permission denied
find: ‘/lost+found’: Permission denied
find: ‘/etc/ssl/private’: Permission denied
find: ‘/etc/polkit-1/localauthority’: Permission denied
find: ‘/etc/lvm/archive’: Permission denied
find: ‘/etc/lvm/backup’: Permission denied
find: ‘/sys/fs/pstore’: Permission denied
find: ‘/proc/tty/driver’: Permission denied
find: ‘/proc/17769/task/17769/fd/6’: No such file or directory
find: ‘/proc/17769/task/17769/fdinfo/6’: No such file or directory
find: ‘/proc/17769/fd/5’: No such file or directory
find: ‘/proc/17769/fdinfo/5’: No such file or directory
find: ‘/cgroup2/csessions’: Permission denied
find: ‘/boot/lost+found’: Permission denied
find: ‘/tmp’: Permission denied
find: ‘/run/lvm’: Permission denied
find: ‘/run/screen/S-bandit14’: Permission denied
find: ‘/run/screen/S-bandit15’: Permission denied
find: ‘/run/screen/S-bandit27’: Permission denied
find: ‘/run/screen/S-bandit10’: Permission denied
find: ‘/run/screen/S-bandit11’: Permission denied
find: ‘/run/screen/S-bandit29’: Permission denied
find: ‘/run/screen/S-bandit9’: Permission denied
find: ‘/run/screen/S-bandit17’: Permission denied
find: ‘/run/screen/S-bandit7’: Permission denied
find: ‘/run/screen/S-bandit26’: Permission denied
find: ‘/run/screen/S-bandit5’: Permission denied
find: ‘/run/screen/S-bandit19’: Permission denied
find: ‘/run/screen/S-bandit0’: Permission denied
find: ‘/run/screen/S-bandit12’: Permission denied
find: ‘/run/screen/S-bandit1’: Permission denied
find: ‘/run/screen/S-bandit22’: Permission denied
find: ‘/run/screen/S-bandit21’: Permission denied
find: ‘/run/screen/S-bandit4’: Permission denied
find: ‘/run/screen/S-bandit18’: Permission denied
find: ‘/run/screen/S-bandit3’: Permission denied
find: ‘/run/screen/S-bandit31’: Permission denied
find: ‘/run/screen/S-bandit23’: Permission denied
find: ‘/run/screen/S-bandit24’: Permission denied
find: ‘/run/screen/S-bandit25’: Permission denied
find: ‘/run/screen/S-bandit20’: Permission denied
find: ‘/run/shm’: Permission denied
find: ‘/run/lock/lvm’: Permission denied
find: ‘/var/spool/bandit24’: Permission denied
find: ‘/var/spool/cron/crontabs’: Permission denied
find: ‘/var/spool/rsyslog’: Permission denied
find: ‘/var/tmp’: Permission denied
find: ‘/var/lib/apt/lists/partial’: Permission denied
find: ‘/var/lib/polkit-1’: Permission denied
/var/lib/dpkg/info/bandit7.password
find: ‘/var/log’: Permission denied
find: ‘/var/cache/apt/archives/partial’: Permission denied
find: ‘/var/cache/ldconfig’: Permission denied

대부분이 Permission denied 로 보임.

여기서 간단하게 리눅스의 File Descriptor에 대해 알아보겠습니다.

 

File Descriptor : 프로세스에서 특정 파일에 접근할 때 사용하는 추상적인 값

 

일반적으로 0, 1, 2번 파일 디스크립터는 특수한 목적으로 사용

• 0 : Standard input, 표준 입력
• 1 : Standard output, 표준 출력
• 2 : Standard error, 표준 에러

지금 우리가 사용한 find 명령어에서 발생하는 출력들은 Permission denied, 즉 표준 에러입니다.

저희는 표준 에러를 지워야합니다 . 

 

이 때 사용하는 것이 Redirection 입니다.

Redirection은 입, 출력의 방향을 지정할 때 사용합니다.

• A > B : A의 결과를 B로 보냅니다(저장).
• A >> B : A의 결과를 기존 B의 데이터에 추가합니다.
• A < B : B의 데이터를 A(명령)에 입력합니다.

이제 우리는 표준에러, 즉 File Descriptor가 2번인 것을 지우도록 합시다.

/dev/null : 리눅스의 쓰레기통

/dev/null은 모든 출력을 제거 해줍니다.

2 > /dev/null : 표준에러를 /dev/null로 보내 출력하지 않습니다.

 

find / -user bandit7 -group bandit6 -size 33c 2>/dev/null

find / -user bandit7 -group bandit6 -size 33c 2>/dev/null
/var/lib/dpkg/info/bandit7.password
bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs
bandit6@bandit:~$

 

 

다음 레벨로 !