OverTheWire Leviathan Guide

Previous Level Guide: Bandit Level 3 → 4

Access

SSH: ssh leviathan4@leviathan.labs.overthewire.org -p 2223

Password: EU7IX6n7em

Info

Description: There is no information for this level, intentionally.

Theory

Not much to do with the details from the task, so just skipping to doing it.

Solution

As always, first we will use ls -la to see all files regardless they are hidden and some details of the files/folders:

~$ ls -la
total 24
drwxr-xr-x  3 root root       4096 Sep 19 07:07 .
drwxr-xr-x 83 root root       4096 Sep 19 07:09 ..
-rw-r--r--  1 root root        220 Mar 31  2024 .bash_logout
-rw-r--r--  1 root root       3771 Mar 31  2024 .bashrc
-rw-r--r--  1 root root        807 Mar 31  2024 .profile
dr-xr-x---  2 root leviathan4 4096 Sep 19 07:07 .trash

The only thing here is a folder called ".trash", let's see what's inside:

~$ cd .trash

~/.trash$ ls -la
total 24
dr-xr-x--- 2 root       leviathan4  4096 Sep 19 07:07 .
drwxr-xr-x 3 root       root        4096 Sep 19 07:07 ..
-r-sr-x--- 1 leviathan5 leviathan4 14936 Sep 19 07:07 bin

There is a single executable file in this trash folder, by the name of "bin" it will be some binary game or something, let's open it to find out:

~/.trash$ ./bin
01101001 00110000 01001110 01001000 01111010 01000100 01110111 01100010 01101100 01101101

If we use ltrace on this we can see that it just takes the next level's password and reads it as binary:

~/.trash$ ltrace ./bin
__libc_start_main(0x80490ad, 1, 0xffffd484, 0 <unfinished ...>
fopen("/etc/leviathan_pass/leviathan5", "r")                              = 0
+++ exited (status 255) +++

Now with this you can either use an online binary to text translator, but if you're anything like me, we'll use the terminal to do it for us. So I found this command online that uses perl to convert what's in the left of the pipe character to binary and viceversa, just by changing it to unpack. Here I'll explain it, because if you don't know what something does that you're pasting into your terminal, you're just dumb or lazy for not doing research. First we take the output from the bin executable, which is just the line of binary, and runs it through the perl interpreter, the -a option enables autosplit mode so it splits the input line into the @F array based on whitespace, the -p option processes the input, and the -e '$_=pack"(B8)*",@F' stuff is the perl code to be executed, in there the dollars symbol with underscore is the input and pattern searcher, while the pack @f stuff converts the binary strings in the @F array to our human readable text, finally the B8 in parenthesis just tells it that the binary is in blocks of 8 characters, basically because in binary spaces don't exist, it's just ones and zeros, so we gotta tell it to join the string in blocks of 8. So just like this we have a command like this:

~/.trash$ ./bin | perl -ape '$_=pack"(B8)*",@F'
i0NHzDwblm

You can read more on the command in this page.

And that's our password! Now you can exit and go to the next level.