Login

SSH: ssh bandit30@bandit.labs.overthewire.org -p 2220

Password: 5b90576bedb2cc04c86a9e924ce42faf

Task

There is a git repository at ssh://bandit30-git@localhost/home/bandit30-git/repo. The password for the user bandit30-git is the same as for the user bandit30.

Clone the repository and find the password for the next level.

A little bit of Theory

The introduction to Git can be found in Level 28 and Level 29.

Git tagging is a way to mark specific points in the history of the repository. One example would be to mark release points of the software. The command to see the tags is git tag. To create a tag the command is git tag -a <tag_name> -m <"tag description/message">. To see more details, like the tag message and commit, you can use the following command: git show <tag_name>.

Solution

Start the same way as before by creating a directory, cloning the repository and checking the README.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

bandit30@bandit:~$ mktemp -d
/tmp/tmp.iFnbTcdMf4
bandit30@bandit:~$ cd /tmp/tmp.iFnbTcdMf4
bandit30@bandit:/tmp/tmp.iFnbTcdMf4$ git clone ssh://bandit30-git@localhost/home/bandit30-git/repo
bandit30@bandit:/tmp/tmp.iFnbTcdMf4$ ls
repo
bandit30@bandit:/tmp/tmp.iFnbTcdMf4$ cd repo
bandit30@bandit:/tmp/tmp.iFnbTcdMf4/repo$ ls -la
total 16
drwxr-sr-x 3 bandit30 root 4096 Jul  3 13:05 .
drwx--S--- 3 bandit30 root 4096 Jul  3 13:05 ..
drwxr-sr-x 8 bandit30 root 4096 Jul  3 13:05 .git
-rw-r--r-- 1 bandit30 root   30 Jul  3 13:05 README.md
bandit30@bandit:/tmp/tmp.iFnbTcdMf4/repo$ cat README.md 
just an epmty file... muahaha

The README does not give us any information. Checking the git tag, we find a point in the history called ‘secret’, which looks promising.

1
2

bandit30@bandit:/tmp/tmp.iFnbTcdMf4/repo$ git tag
secret

Looking at this, we find the password for the next level.

1
2

bandit30@bandit:/tmp/tmp.iFnbTcdMf4/repo$ git show secret
47e603bb428404d265f59c42920d81e5

https://overthewire.org/wargames/bandit/bandit31.html