Behemoth5
Behemoth Level 5 — a privileged program sends data over the network to localhost, so you must set up a listener to receive it.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
There is no information for this level, intentionally.
Study guide
Level map: logged in as behemoth5, find the password for behemoth6.
What this level teaches
Understanding a program’s network behaviour and writing a matching receiver.
Key ideas
- Observe the syscalls.
straceshows the program opening a file, creating a socket and sending data, including the destination address and port. - Datagram sockets. UDP does not need a connection, so a listener simply receives whatever arrives.
- Be the server. Netcat can listen on the right port and protocol.
- Race to be ready. The listener must be running before the program sends.
How to approach it
- Trace the program to learn what it sends and where.
- Start a listener on the right port and protocol in a second terminal or in the background.
- Run the program and read what arrives.
Why it matters
Programs that phone home or log over the network are everywhere, and knowing how to capture that traffic is a basic analysis step.