Level: 0→1
Level: 1→2
Level: 2→3
Level: 3→4
Level: 4→5
Level: 5→6
Level: 6→7
Level: 7→8
Level: 8→9
Level: 9→10
Level: 10→11
Level: 11→12
Level: 12→13
Level: 13→14
Level: 14→15
Level: 15→16
Level: 16→17
Level: 17→18
Level: 18→19
Level: 19→20
Level: 20→21
Level: 21→22
Level: 22→23
Level: 23→24
Level: 24→25
Level: 25→26
Level: 26→27
Level: 27→28
Level: 28→29
Level: 29→30
Level: 30→31
Level: 31→32
Level: 32→33
Level: 33→34

~ Level 28→29 ~

Level Description

There is a git repository at ssh://bandit28-git@localhost/home/bandit28-git/repo. The password for the user bandit28-git is the same as for the user bandit28.

Clone the repository and find the password for the next level.

Commands that may be required: git

Research Before Solving

Research will be done during the solution walkthrough.

Solution Walkthrough

We will first create a directory under /tmp so that we may work. Mine is known as /tmp/user. Proceed to change into that directory using cd /tmp/user We can now issue the command to clone the provided repository so that we may search for the password: git clone ssh://bandit28-git@localhost/home/bandit28-git/repo

You will be prompted again to confirm the connection and to enter the appropriate password. After these, confirmation will be provided once the repository is cloned.

Immediately use ls to list the contents, then use cd to move into the repo directory. Using ls again, we find a file by the name of README.md.

We are presented with text that provides the username and password associated with bandit29 though we see that the password itself is replaced with all X's. Going through the man pages, it is found that git log shows us information logs regarding commits of files that were uploaded, changed, or otherwise removed. Upon entering this command into the shell prompt, we see the following:

output of git log command showing changes to file(s)

At the bottom we see the initial commit of the README.md file. The next commit says missing data was added, and the top-most commit states an info leak was fixed. Thinking through this, the bottom and top file do not show the password for one reason or another and the middle file will. We need to use the man pages to locate a command that will allow us to see the difference between each commit. Enter git diff

The third entry down in the synopsis section denotes the proper syntax to compare two commits. Our command will appear like this: git diff de2ebe2d5fd1598cd547f4d56247e053be3fdc38 c086d11a00c0648d095d04c089786efef5e01264

We've found the password! bbc96594b4e001778eee9975372716b2. Just like the last level, we want to remove our /tmp/user directory and all of its contents before continuing on. To do so, use rm -rf /tmp/user

Previous Level

Next Level