what is overthewire?
overthewire is a site dedicated to providing a safe,
stable environment to learn about different cybersecurity concepts and techniques. it is free and
anonymous, and you won't get in trouble for participating. it's a great site. this series of posts
will cover the concepts and techniques introduced in "bandit", their first wargame.
what's a wargame?
in this context, a "wargame" is a series of challenges designed to teach, train, and entertain through
hacking in a simulated environment. the environment is intentionally designed to have certain vulnerabilities,
so that players can progress along the same path. each level revolves around attempting to locate and expose a
password, which will allow you to log in to the next level.
the "bandit" wargame is designed for beginners in the IT/cybersec field. it focuses more on teaching the basics
of using linux, with just a little bit of security. the next wargames in the series are much more security focused.
don't skip "bandit", though, it's important to learn.
how does this series of essays work?
well, first of all, this is not really a "step 1, step 2, ..." walkthrough. it's meant to be an explanation of the
topics that a player will encounter in "bandit". it is my view that learning the concepts in depth is far more valuable
than just getting all the passwords. there is no prize for finishing these wargames outside of knowledge.
to that end, you won't find any passwords here, current or old. giving out the credentials would undermine both the purpose
of the games and my own reasons for writing here.
finally, i am by no means an expert. i am, more or less, learning alongside you as i write these. keep that in mind as you read.
conventions
- code snippets will be clearly marked
like this. snippets that begin with -$
represent commands to be entered at your command prompt. -$ represents the prompt itself and is not part
of the command.
- in code snippets, italics represent placeholder names and values. these are to be replaced with the correct values when the
command is used.
- these write-ups will have many outside resources linked. these are resources that i found particularly useful, and i recommend you
read them as well.
- yes, the walkthroughs seem frustratingly vague. this is intentional. if you read the actual information in each part, you'll be fine.
don't skip the good stuff just to find the answers, because that's not how this works here.
0.1 - linux
linux is the name for dozens of variations of a kernel built on
the GNU operating system. it was designed by Linus Torvalds in 1991. since
then, it has evolved and branched into countless fully fledged operating systems used around the world by hobbyists, professionals, governments,
corporations, and many others.
linux has been adapted to suit any need you can think of. besides personal computers, major tech companies and organizations like amazon, google, and
even NASA use linux on their servers, products, and embedded devices. the majority of smartphones on the planet run on android, a version of linux. in
fact, this very website was written on a pc running ubuntu linux, and is hosted on a linux server, thanks to cloudflare.
0.2 - the linux file system
linux differs from windows* computers mainly in how the operating system is structured. at ground level, it takes the form of a massive "tree" of
nested directories in different branches. collectively, this is referred to as the
Linux File System, but i'll call
it LFS for short. different directories hold different types of files and objects, such as binaries (executable software), config files (basically settings),
documents, media, and so on.
the top (or bottom, if you prefer) of the LFS is fittingly called the "root" directory. everything else on the system falls under, and branches out from, root.
very often, only special users will have "root access", or the ability to work in root, because of the damage it can cause. the term "root access" also refers
to the highest level of permissions available on a system, which is completely unhindered access to all parts and contents of the LFS.
some key directories to be aware of include:
/home (/~ shorthand)
/home is where all of a user's personal stuff is found, like documents, media, etc.
/lib
this directory contains libraries of code to be used by programs written and run on the system.
/media
this is where removable storage such as usb drives will be mounted.
/bin
this directory contains precompiled software and executable files. much of the tools you will use are stored here
/tmp
this directory is meant to hold temporary files and objects, stuff that isn't supposed to be kept for long.
/etc
the /etc directory is the home of most, if not all, the config files on the system. users joke that "etc" stands
for "everything to configure".
/var
/var holds logs generated by processes and services running on the system.
there are many other directories in the LFS, but these are (in my estimation) a good set to start with.
* macos is different too, but is a little more similar due to being based on unix, like linux.
0.3 - remotely connecting
because many servers (including the one hosting "bandit") run on linux, it is important to know how to remotely connect to a server. back
in the day, the protocol of choice was called telnet, short for
"teletype network". it is designed to connect two machines remotely and provide two-way transmission for the purposes of communication and
command execution.
telnet still exists, but has almost entirely fallen out of favor. because it was designed before the mainstream adoption of the internet, it
lacks any sort of encryption measures or security, making it unsuitable for transmitting any type of sensitive data.
these days, everyone uses SSH, which stands for "Secure Shell". SSH uses
public key cryptography to secure its communications, making it
much safer to use, even on an otherwise unsecure network.
SSH allows a remote user to operate as though they are logged into a machine locally, so they can traverse the machine, read/write/execute files,
and do anything else a local user could.
most, if not all, linux distributions has OpenSSH (an open-source ssh client) installed by default. it can be executed with the
ssh command. executing the command by itself will display the usage dialogue, so the user must specify the name of the
remote host, the port to to which they are connecting (22 is the default), and the username with which they are logging in.
most properly secured servers will require some form of authentication from the user to accept the connection. this often comes in the form of a
username/password combination. the username is given in the initial connection command, and the server will prompt the user for the password upon
connection.
in other cases, the user can structure the connection command to use an encrypted "key" file, which serves the same purpose as a password, but is
near-impossible for anyone else to guess or brute-force.
an ssh connection using a password will look like this:
-$ssh username@hostname -p port
username's password:
an ssh connection using a keyfile will look like this:
-$ssh -i keyfile username@hostname -p port
0.4 - first steps, and getting help
in many cases, a linux machine (especially a server or embedded device) will not have a graphical user interface, or GUI. all of the work a user does
will be through the command line.
as a result, it can be easy for new users to get stuck and/or lost. below is a list of commands to help you out of a jam:
whoami
usage: -$whoami
this command simply prints the username of the currently active user.
example:
-$whoami
plasticglass
pwd
usage: -$pwd
prints the path (from /home) to where the user is currently located.
example:
-$pwd
/home/plasticglass/projects/website
tree
usage: -$tree
displays the contents of a directory in tree format. use the -a tag to also list
subdirectories.
man
usage: -$man command
opens the manual page of a
specified command.
-h
usage: command -h
prints a short help page for a specified command.
if you find yourself unsure of what to do next or where to go, try these out. it's very likely that you'll find
your answer there.