Challenge Information
Platform: OverTheWire
Wargame: Bandit
Levels: 01-08
Introduction and Configuration
Basic idea: Complete level x to advance to level x+1. The general SSH connection syntax follows this pattern, where x represents the current level number:
SSH Connection Details
- Host:
bandit.labs.overthewire.org - Port: 2220
Connecting with:
ssh [email protected] -p 2220
Initial Connection
Objective: The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.
Solution: After logging in with the provided credentials, we receive a welcome message containing the general game rules and additional useful tips.
# connect to the lab
ssh [email protected] -p 2220
Level 00
Objective: The password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.
Solution: We display the file contents, copy the flag, and exit the shell. We then use this flag as the password to log into the next level with the username bandit1.
# print the file to stdout
cat readme
...
# exit the shell
exit
Level 01
Objective: The password for the next level is stored in a file called ‘-’ located in the home directory.
Solution: We use the dot-slash (./) prefix to specify that the file resides in the current directory, preventing the shell from interpreting the hyphen as a command option.
# print the file to stdout
cat ./-
Level 02
Objective: The password for the next level is stored in a file called spaces in this filename located in the home directory.
Solution: We enclose the filename in double (") or single (’) quotation marks to preserve the spaces.
# print the file to stdout
cat "spaces in this filename"
Level 03
Objective: The password for the next level is stored in a hidden file in the inhere directory.
Solution: We list the files in the current directory using the -a option to include hidden files (those beginning with a dot).
# list the files in the current directory (hidden files included)
ls -hla
...
# change directory
cd inhere/
# list the files in the current directory (hidden files included)
ls -hla
...
# print contents of the hidden file to stdout
cat .hidden
...
# copy the flag—flag format: (flag)[0-9a-zA-Z]{32}
Level 04
Objective: The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the ‘reset’ command.
Solution: We use the ll command rather than ls -alF. An alias for ll is predefined in the ~/.bashrc file.
# alias for ll is defined in ~/.bashrc
...
alias ll='ls -alF'
...
The complete terminal interaction follows:
# list files
ll
...
# change current directory
cd inhere/
# list files
ll
...
# check the file type for every file in the directory
file ./-file0*
...
# print the content of the only ASCII text file in the directory
cat ./-file07
# grab the flag
...
Level 05
Objective: The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties:
- human-readable,
- 1033 bytes in size,
- not executable.
Solution: We use the find command to restrict our search according to the specified criteria.
# search only in the current directory
find . -size 1033c -type f \! -executable
Level 06
Objective: The password for the next level is stored somewhere on the server and has all of the following properties:
- owned by user bandit7,
- owned by group bandit6,
- 33 bytes in size.
Solution: As before, we use the find command to narrow our search. We redirect error messages to /dev/null to suppress permission-denied errors.
# search the entire file system
find / -user bandit7 -group bandit6 -size 33c 2>/dev/null
Level 07
Objective: The password for the next level is stored in the file data.txt next to the word millionth.
Solution: We use the grep command to search the file for the keyword.
# use pipes to redirect output to program input
cat data.txt | grep millionth
Level 08
Objective: The password for the next level is stored in the file data.txt and is the only line of text that occurs only once.
Solution: We first sort the output, then filter for unique lines using the uniq command.
# use pipes to chain multiple commands
cat data.txt | sort | uniq -u