Skip to main content

Bandit Level 31 → 32

Shubham
Shubham
Cybersecurity Enthusiast

Login: ssh bandit31@bandit.labs.overthewire.org -p 2220
Password: fb5S2xb7bRyFmAvQYQGEqsbhVyJqhnDy

task​

There is a git repository at ssh://bandit31-git@bandit.labs.overthewire.org:2220/home/bandit31-git/repo. The goal is to push a file named key.txt with the content "May I come in?" to the remote master branch to receive the next password.

theory lil bit​

  1. The .gitignore File: This is a special file that tells Git which files or patterns to ignore. If *.txt is in .gitignore, Git will refuse to track any .txt files by default.
  2. Git Add: To track a new file, it must be staged using git add. If a file is ignored by .gitignore, you may need to modify the ignore file or use git add -f to force it.
  3. Git Commit & Push: git commit records your local changes, and git push sends those commits to the remote server.
  4. Pre-receive Hooks: Remote servers can run scripts (hooks) when you push. In this level, a hook validates your submission and prints the password before technically "declining" the push to reset the level for others.

solution​

# Clone the repository
┌──(sssubhammm ⌘ macbook-air)-[~]
└─$ git clone ssh://bandit31-git@bandit.labs.overthewire.org:2220/home/bandit31-git/repo
Cloning into 'repo'...
bandit31-git@bandit.labs.overthewire.org's password: 

# Navigate to the repo and create the required file
┌──(sssubhammm ⌘ macbook-air)-[~/repo]
└─$ cd repo
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ echo "May I come in?" > key.txt

# Notice that key.txt is ignored by .gitignore
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ cat .gitignore
*.txt

# Remove the restriction from .gitignore so Git can see the file
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ nvim .gitignore 
# (Remove or comment out *.txt)

# Stage the files and commit the change
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ git add .
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ git commit -m "add key file"

# Push to the remote master branch
┌──(sssubhammm ⌘ macbook-air)-[~/repo/repo]
└─$ git push origin master
bandit31-git@bandit.labs.overthewire.org's password: 
remote: ### Attempting to validate files... ####
remote: 
remote: Well done! Here is the password for the next level:
remote: 3O9RfhqyAlVBEZpVb6LYStshZoqoSx5K 
remote: 
To ssh://bandit.labs.overthewire.org:2220/home/bandit31-git/repo
 ! [remote rejected] master -> master (pre-receive hook declined)

<!-- truncate -->