Bandit Level 15 → Level 16

 

Goal

The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…

다음 레벨의 패스워드는 현재 레벨의 패스워드를 localhost의 30001 포트(SSL)로 전송하면 획득할 수 있다.

노트: "HEARTBEATING"과 "Read R BLOCK"이 뜬다면? `-ign_eof`를 사용하고 man 페이지의 "CONNECTED COMMANDS" 부분을 읽어라. 'R'과 'Q' 옆에 있는 'B' 커맨드는 이 버전의 명령에서도 동작한다.

 

Commands you may need to solve this level

`ssh`, `telnet`, `nc`, `openssl`, `s_client`, `nmap`

 

Write Up

bandit15@bandit:~$ nc -zv 127.0.0.1 30001
Connection to 127.0.0.1 30001 port [tcp/*] succeeded!

 

30001번 포트는 열려 있으나 `nc`는 기본적으로 평문 통신을 하기 때문에 현재 레벨의 플래그를 단순 전송하면 튕긴다.

s_client
           This implements a generic SSL/TLS client which can establish a transparent connection to a remote server speaking
           SSL/TLS. It's intended for testing purposes only and provides only rudimentary interface functionality but internally
           uses mostly all functionality of the OpenSSL ssl library.

bandit15@bandit:~$ openssl s_client -connect 127.0.0.1:30001

 

---

Heardbleed(https://en.wikipedia.org/wiki/Heartbleed)