[OverTheWire] bandit 22 -> 23

A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

 

hint : cron, crontab, crontab(5) (use “man 5 crontab” to access this)

 

이번에도 21번 문제와 유사합니다 우선 /etc/cron.d를 들어가봅시다

bandit22@bandit:~$ ls
bandit22@bandit:~$ cd /etc/cron.d

bandit22@bandit:/etc/cron.d$ ls
behemoth4_cleanup  cronjob_bandit22  cronjob_bandit24  leviathan5_cleanup    otw-tmp-dir
clean_tmp          cronjob_bandit23  e2scrub_all       manpage3_resetpw_job  sysstat

bandit22@bandit:/etc/cron.d$ cat cronjob_bandit23
@reboot bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null

 

 

이번에도 /usr/bin안에 cronjob_bandit23.sh 파일을 실행시켜서 crontab을 실행중이라고 하네요

cronjob_bandit23.sh파일을 한 번 읽어봅시다!

bandit22@bandit:/etc/cron.d$ cd /usr/bin

bandit22@bandit:/usr/bin$ cat cronjob_bandit23.sh
#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget

 

 

명령어를 위에 다 알려주긴 했는데 지금 서버 사용자로 whoami를 치면 bandit22가 나오겠죠? 그런데 우리는 bandit23으로 가는 password를 찾아야하니까 살짝 바꿔서 사용해봅시다

bandit22@bandit:/usr/bin$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1
8ca319486bfbbc3663ea0fbe81326349

bandit22@bandit:/usr/bin$ cd /tmp

bandit22@bandit:/tmp$ cat 8ca319486bfbbc3663ea0fbe81326349
0Zf11ioIjMVN551jX3CmStKLYqjk54Ga

password 찾기 성공~