Level 16 → 17
Last updated
Last updated
The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL/TLS and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.
Helpful note: Getting “DONE”, “RENEGOTIATING” or “KEYUPDATE”? Read the “CONNECTED COMMANDS” section in the manpage.
Use nmap to scan for open ports and services:
nmap: Network exploration tool and security scanner
-sV: Probe open ports to determine service/version info
localhost: The target (the working machine)
-p 31000-32000: Specifies the port range to scan
The SSL/TLS port 31790 was identified from the nmap results.
Connect to the SSL port and submit the bandit15 password:
echo "...": Outputs the RSA Private Key
|: Pipes the output to the next command
openssl s_client: OpenSSL command for testing SSL/TLS connections
-connect localhost:31790: Specifies the host and port to connect to
-ign_eof: Ignores EOF (end-of-file), keeping the connection open
This outputs the RSA Private Key.
Save the RSA Private Key to a file:
echo "...": Outputs the RSA Private Key
>: Redirects the output to a file
~/Desktop/sshkey_private_b17: The file path and name to save the key
Change the permissions of the key file for security:
chmod: Changes the permissions of the file
600: Sets read and write permissions for the owner only
Use the private key to access the next level:
Port scanning tools like nmap are essential for identifying open ports and services
Not all open ports use the same protocol; distinguishing between SSL and non-SSL services is important
Private keys can be transmitted as text and need to be properly saved and secured
-- Othmane
