{"id":1249,"date":"2019-09-11T23:26:27","date_gmt":"2019-09-11T15:26:27","guid":{"rendered":"http:\/\/van-yzt.com\/?p=1249"},"modified":"2019-09-11T23:54:11","modified_gmt":"2019-09-11T15:54:11","slug":"bandit-level-25-%e2%86%92-level-26","status":"publish","type":"post","link":"https:\/\/huzi-baozi.com\/?p=1249","title":{"rendered":"Bandit Level 25 \u2192 Level 26"},"content":{"rendered":"<p>Logging in to bandit26 from bandit25 should be fairly easy\u2026 The shell for user bandit26 is not \/bin\/bash, but something else. Find out what it is, how it works and how to break out of it.<\/p>\n<h2>\n\u89e3\u5bc6<\/h2>\n<p>\u4f7f\u7528<code>ssh -i<\/code>\u767b\u9646bandit24\u53d1\u73b0\u76f4\u63a5\u9000\u51fa\uff0c\u4f46\u662f\u5728\u9000\u51fa\u524d\u6253\u5370\u4e86\u5f88\u591a\u5185\u5bb9\u3002<br \/>\n\u8fd9\u4e2a\u65f6\u5019\uff0c\u628a\u7ec8\u7aef\u9ad8\u5ea6\u7f29\u5c0f\u5230\u53ea\u6709\u51e0\u884c\uff08\u4e0d\u80fd\u5b8c\u5168\u6253\u5370\u767b\u9646\u5185\u5bb9\uff09\uff0c\u518d\u6b21\u767b\u9646\uff0c\u4f1a\u53d1\u73b0\u8f93\u51fa\u4fe1\u606f\u4e0d\u5b8c\u5168\uff0c\u5e76\u4e14\u6ca1\u6709\u8fc5\u901f\u9000\u51fa\u3002<br \/>\n\u6b64\u65f6\uff0c\u76f4\u63a5\u6309<code>v<\/code>\u8fdb\u5165VIM\uff0c\u5c31\u4fdd\u5b58\u4f4f\u4e86bandit26\u7684\u767b\u9646\u3002<br \/>\n\u4f7f\u7528VIM\u547d\u4ee4\u6a21\u5f0f\uff0c\u6253\u5f00bandit26\u7684\u5bc6\u7801\u6587\u4ef6\uff1ae \/etc\/bandit_pas\/bandit26\u3002<br \/>\n\u5f97\u5230\u5bc6\u7801\uff1a<code>5czgV9L3Xx8JPOyRbXh6lQbmIOWvPT6Z<\/code><br \/>\n\u4e0d\u8fc7\u4f9d\u65e7\u5728VIM\u91cc\uff0c\u65e0\u6cd5\u505a\u4ec0\u4e48\u4e8b\u60c5\uff08\u4e00\u4e9b\u73af\u5883\u53d8\u91cf\u90fd\u6ca1\u6709\uff0c\u65e0\u6cd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff09\u3002\u6211\u4eec\u8bbe\u7f6e\u4e0b\u53d8\u91cf<code>set shell=\/bin\/bash<\/code>\uff0c\u7136\u540e\u518d\u6267\u884c<code>shell<\/code>\uff0c\u5c31\u6210\u529f\u4f7f\u7528bash\u4e86\u3002<\/p>\n<h2>\n\u77e5\u8bc6\u70b9<\/h2>\n<ol>\n<li>\nVIM\u7684\u57fa\u672c\u64cd\u4f5c\uff1b<\/li>\n<li>\nVIM\u7684\u547d\u4ee4\uff1b<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Logging in to bandit26 from bandit25 should be fairly easy\u2026 The shell for user bandit26 is not \/bin\/bash, but something else. Find out what it is, how it works and how to break out of it. \u89e3\u5bc6 \u4f7f\u7528ssh -i\u767b\u9646bandit24\u53d1\u73b0\u76f4\u63a5\u9000\u51fa\uff0c\u4f46\u662f\u5728\u9000\u51fa\u524d\u6253\u5370\u4e86\u5f88\u591a\u5185\u5bb9\u3002 \u8fd9\u4e2a\u65f6\u5019\uff0c\u628a\u7ec8\u7aef\u9ad8\u5ea6\u7f29\u5c0f\u5230\u53ea\u6709\u51e0\u884c\uff08\u4e0d\u80fd\u5b8c\u5168\u6253\u5370\u767b\u9646\u5185\u5bb9\uff09\uff0c\u518d\u6b21\u767b\u9646\uff0c\u4f1a\u53d1\u73b0\u8f93\u51fa\u4fe1\u606f\u4e0d\u5b8c\u5168\uff0c\u5e76\u4e14\u6ca1\u6709\u8fc5\u901f\u9000\u51fa\u3002 \u6b64\u65f6\uff0c\u76f4\u63a5\u6309v\u8fdb\u5165VIM\uff0c\u5c31\u4fdd\u5b58\u4f4f\u4e86bandit26\u7684\u767b\u9646\u3002 \u4f7f\u7528VIM\u547d\u4ee4\u6a21\u5f0f\uff0c\u6253\u5f00bandit26\u7684\u5bc6\u7801\u6587\u4ef6\uff1ae \/etc\/bandit_pas\/bandit26\u3002 \u5f97\u5230\u5bc6\u7801\uff1a5czgV9L3Xx8JPOyRbXh6lQbmIOWvPT6Z \u4e0d\u8fc7\u4f9d\u65e7\u5728VIM\u91cc\uff0c\u65e0\u6cd5\u505a\u4ec0\u4e48\u4e8b\u60c5\uff08\u4e00\u4e9b\u73af\u5883\u53d8\u91cf\u90fd\u6ca1\u6709\uff0c\u65e0\u6cd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff09\u3002\u6211\u4eec\u8bbe\u7f6e\u4e0b\u53d8\u91cfset shell=\/bin\/bash\uff0c\u7136\u540e\u518d\u6267\u884cshell\uff0c\u5c31\u6210\u529f\u4f7f\u7528bash\u4e86\u3002 \u77e5\u8bc6\u70b9 VIM\u7684\u57fa\u672c\u64cd\u4f5c\uff1b VIM\u7684\u547d\u4ee4\uff1b<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1249","post","type-post","status-publish","format-standard","hentry","category-bandit"],"_links":{"self":[{"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/posts\/1249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1249"}],"version-history":[{"count":3,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/posts\/1249\/revisions"}],"predecessor-version":[{"id":1252,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=\/wp\/v2\/posts\/1249\/revisions\/1252"}],"wp:attachment":[{"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/huzi-baozi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}