LinkedInGitHub

Level 16 → 17

Level Goal

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL/TLS and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Helpful note: Getting “DONE”, “RENEGOTIATING” or “KEYUPDATE”? Read the “CONNECTED COMMANDS” section in the manpage.

Write-Up

  1. Use nmap to scan for open ports and services:

nmap -sV localhost -p 31000-32000

  • nmap: Network exploration tool and security scanner

  • -sV: Probe open ports to determine service/version info

  • localhost: The target (the working machine)

  • -p 31000-32000: Specifies the port range to scan

nmap -sV localhost -p 31000-32000

The SSL/TLS port 31790 was identified from the nmap results.

  1. Connect to the SSL port and submit the bandit15 password:

  • echo "...": Outputs the RSA Private Key

  • |: Pipes the output to the next command

  • openssl s_client: OpenSSL command for testing SSL/TLS connections

  • -connect localhost:31790: Specifies the host and port to connect to

  • -ign_eof: Ignores EOF (end-of-file), keeping the connection open

echo "kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx" | openssl s_client -connect localhost:31790 -ign_eof

This outputs the RSA Private Key.

  1. Save the RSA Private Key to a file:

  • echo "...": Outputs the RSA Private Key

  • >: Redirects the output to a file

  • ~/Desktop/sshkey_private_b17: The file path and name to save the key

Save the RSA Private Key to a file

  1. Change the permissions of the key file for security:

  • chmod: Changes the permissions of the file

  • 600: Sets read and write permissions for the owner only

  1. Use the private key to access the next level:

Lessons Learned

  • Port scanning tools like nmap are essential for identifying open ports and services

  • Not all open ports use the same protocol; distinguishing between SSL and non-SSL services is important

  • Private keys can be transmitted as text and need to be properly saved and secured

-- Othmane

PreviousLevel 15 → 16NextLevel 17 → 18

Last updated

Was this helpful?