背景

OverTheWire:Bandit是一個學習linux命令的WarGame，通過闖關的模式，不斷的學習新的命令，對於學習安全和Linux的朋友是一個很好的練習遊戲，網址是 http://overthewire.org/wargames/bandit/ 。
這個遊戲目前有34關，從Level0—Level34。遊戲形式是通過ssh連接遊戲服務器，通過各種命令行讀取下一關的遊戲服務器密鑰，然後連接下一關的服務器繼續讀取，直到通關。

SSH Information
Host: bandit.labs.overthewire.org
Port: 2220

通關過程

Level 0

The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.
這一關主要是讓你選擇一個合適ssh工具開始遠程，這一關的用戶名和密碼均爲bandit0常見的有secureCRT，Xshell, Putty, 不過我最近發現一款免費而且不比Xshell功能少的SSH工具叫MobaXterm，個人推薦。
Linux下更爲方便

ssh [email protected] -p 2220
密碼：bandit0

Level 0–>Level 1

he password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.
Commands you may need to solve this level
ls, cd, cat, file, du, find
其中du命令是用來查看令也是查看使用空間的，但是與df命令不同的是Linux du命令是查看當前指定文件或目錄(會遞歸顯示子目錄)佔用磁盤空間大小，還是和df命令有一些區別的

bandit0@bandit:~$ ls
readme
bandit0@bandit:~$ cat readme
boJ9jbbUNNfktd78OOpsqOltutMc3MY1

得到下一關用戶名bandit1，密碼爲boJ9jbbUNNfktd78OOpsqOltutMc3MY1，之後用戶名依次類推，不做贅述

Level 1 - Level 2

Level Goal
The password for the next level is stored in a file called - located in the home directory

Commands you may need to solve this level
ls, cd, cat, file, du, find
ls發現文件名是一個-，但是這個在linux中有特殊意義導致直接cat不好用

bandit1@bandit:~$ ls
-
bandit1@bandit:~$ cat -
^Z
[1]+  Stopped                 cat -
bandit1@bandit:~$ pwd
/home/bandit1
bandit1@bandit:~$ cat /home/bandit1/-
CV1DtqXWVFXTvM2F0k09SHz0YwRINYA9

直接輸入絕對路徑讀取

Level 2 - Level 3

Level Goal
The password for the next level is stored in a file called spaces in this filename located in the home directory

Commands you may need to solve this level
ls, cd, cat, file, du, find

Helpful Reading Material
Google Search for “spaces in filename”
文件名有空格的讀取

bandit2@bandit:~$ cat spaces\ in\ this\ filename
UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK

用cat命令，然後Tab按鍵補齊，自動將空格轉義，實現了密鑰讀取，或者給文件名加上雙引號也可以讀取。

Level 3 → Level 4

Level Goal
The password for the next level is stored in a hidden file in the inhere directory.

Commands you may need to solve this level
ls, cd, cat, file, du, find
密鑰寫在一個隱藏文件裏面，通過ls -a參數可以找到隱藏文件

bandit3@bandit:~$ ls
inhere
bandit3@bandit:~$ cd inhere/
bandit3@bandit:~/inhere$ ls
bandit3@bandit:~/inhere$ ls -la
total 12
drwxr-xr-x 2 root    root    4096 Oct 16 14:00 .
drwxr-xr-x 3 root    root    4096 Oct 16 14:00 ..
-rw-r----- 1 bandit4 bandit3   33 Oct 16 14:00 .hidden
bandit3@bandit:~/inhere$ cat .hidden
pIwrPrtPN36QITSp3EQaw936yaFoFgAB

Level 4 → Level 5

Level Goal
The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the “reset” command.

Commands you may need to solve this level
ls, cd, cat, file, du, find
文件說在人類能讀懂的文件裏面，可以看到當前目錄有9個文件，通過file命令可以用於辨識文件類型。

bandit4@bandit:~$ ls
inhere
bandit4@bandit:~$ cd inhere/
bandit4@bandit:~/inhere$ ls -a
.   -file00  -file02  -file04  -file06  -file08
..  -file01  -file03  -file05  -file07  -file09
bandit4@bandit:~/inhere$ file ./*
./-file00: data
./-file01: data
./-file02: data
./-file03: data
./-file04: data
./-file05: data
./-file06: data
./-file07: ASCII text
./-file08: data
./-file09: data
bandit4@bandit:~/inhere$ cat ./-file07
koReBOKuIDDepwhWk7jZC0RTdopnAYKh
bandit4@bandit:~/inhere$

Level 5 → Level 6

Level Goal
The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties:

human-readable
1033 bytes in size
not executable
Commands you may need to solve this level
ls, cd, cat, file, du, find

一看有這麼多文件夾

bandit5@bandit:~$ ls
inhere
bandit5@bandit:~$ cd inhere/
bandit5@bandit:~/inhere$ ls -a
.            maybehere02  maybehere06  maybehere10  maybehere14  maybehere18
..           maybehere03  maybehere07  maybehere11  maybehere15  maybehere19
maybehere00  maybehere04  maybehere08  maybehere12  maybehere16
maybehere01  maybehere05  maybehere09  maybehere13  maybehere17

根據特徵我們可以用find 命令，找到一個符合條件的文件

bandit5@bandit:~/inhere$ find . -type f -size 1033c
./maybehere07/.file2
bandit5@bandit:~/inhere$ cat ./maybehere07/.file2
DXjZPULLxYr17uwoI01bNLQbtFemEgo7

附find參數解析
-size n[cwbkMG] : 檔案大小爲 n 個由後綴決定的數據塊。其中後綴含義爲：
b: 代表 512 位元組的區塊（如果用戶沒有指定後綴，則默認爲 b）
c: 表示字節數
k: 表示 kilo bytes （1024字節）
w: 字（2字節）
M:兆字節（1048576字節）
G: 千兆字節（1073741824字節）
-type c : 檔案類型是 c 。
d: 目錄
c: 字型裝置檔案
b: 區塊裝置檔案
p: 具名貯列
f: 一般檔案
l: 符號連結
s: socket

Level 6 → Level 7

Level Goal
The password for the next level is stored somewhere on the server and has all of the following properties:

owned by user bandit7
owned by group bandit6
33 bytes in size
Commands you may need to solve this level
ls, cd, cat, file, du, find, grep
又是找文件，那麼依然可以使用find命令，只不過參數稍稍的改變

bandit6@bandit:~$ find / -size 33c -user bandit7 -group bandit6 2>/dev/null
/var/lib/dpkg/info/bandit7.password
bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs

後面的2>/dev/null因爲find命令在根目錄下查找會經常有很多權限的報錯信息，所有在linux中通常用這種方式將錯誤信息重定向到“黑洞中”

Level 7 → Level 8

Level Goal
The password for the next level is stored in the file data.txt next to the word millionth