Description

One port in the range 31000-32000 on localhost accepts the current password over SSL and returns an RSA private key for bandit17. Other ports in the range simply echo back what they receive.

Overview

• nmap with service detection (-sV) identifies which ports are open and what service runs on each.
• The correct port accepts SSL and does not echo; submitting the password returns an RSA private key.
• The key is used to log in as bandit17.

Solution

Step 1: Port Scan

nmap -sV localhost -p 31000-32000

• Filter results to find the port that is not running an echo service.
• The target port is 31790.

Step 2: Submit Password and Receive Key

echo <password> | openssl s_client -connect localhost:31790 -ign_eof

• Save the RSA private key block to a file and use it to SSH as bandit17.

Password

Stored as an RSA private key; bandit17 password is VxCazJaVykI6W36BkBU0mJTCM8rR95XT (readable after login via the key).