overthewire bandit war games

ssh bandit0@bandit.labs.overthewire.org -p 2220

bandit0@bandit:~$ pwd
/home/bandit0
bandit0@bandit:~$ ls
readme
bandit0@bandit:~$ cat readme
Congratulations on your first steps into the bandit game!!
Please make sure you have read the rules at https://overthewire.org/rules/
If you are following a course, workshop, walkthrough or other educational activity,
please inform the instructor about the rules as well and encourage them to
contribute to the OverTheWire community so we can keep these games free!

The password you are looking for is: [Redacted]

bandit1@bandit:~$ cat ./-
[Redacted]
bandit1@bandit:~$

bandit2@bandit:~$ ls
spaces in this filename
bandit2@bandit:~$ cat "spaces in this filename"
[Redacted]
bandit2@bandit:~$ cat spaces\ in\ this\ filename
[Redacted]
bandit2@bandit:~$

bandit3@bandit:~/inhere$ cd ..
bandit3@bandit:~$ ls
inhere
bandit3@bandit:~$ cd inhere/
bandit3@bandit:~/inhere$ ls -a
.  ..  ...Hiding-From-You
bandit3@bandit:~/inhere$ cat ...Hiding-From-You
[REDACTED]

LS(1)                                                            User Commands                                                            LS(1)

NAME
       ls - list directory contents

SYNOPSIS
       ls [OPTION]... [FILE]...

DESCRIPTION
       List  information  about  the  FILEs (the current directory by default).  Sort entries alphabetically if none of -cftuvSUX nor --sort is
       specified.

       Mandatory arguments to long options are mandatory for short options too.

       -a, --all
              do not ignore entries starting with .

       -A, --almost-all
              do not list implied . and ..

bandit4@bandit:~$ ls
inhere
bandit4@bandit:~$ cd inhere/
bandit4@bandit:~/inhere$ ls
-file00  -file01  -file02  -file03  -file04  -file05  -file06  -file07  -file08  -file09
bandit4@bandit:~/inhere$ file ./*
./-file00: PGP Secret Sub-key -
./-file01: data
./-file02: data
./-file03: data
./-file04: data
./-file05: data
./-file06: data
./-file07: ASCII text
./-file08: data
./-file09: data
bandit4@bandit:~/inhere$

bandit4@bandit:~/inhere$ cat ./-file07
[REDACTED]

human-readable
1033 bytes in size
not executable

bandit5@bandit:~/inhere$ ls
maybehere00  maybehere02  maybehere04  maybehere06  maybehere08  maybehere10  maybehere12  maybehere14  maybehere16  maybehere18
maybehere01  maybehere03  maybehere05  maybehere07  maybehere09  maybehere11  maybehere13  maybehere15  maybehere17  maybehere19
bandit5@bandit:~/inhere$ find -type f  -readable -size 1033c ! -executable
./maybehere07/.file2
bandit5@bandit:~/inhere$ cat ./maybehere07/.file2
[REDACTED]

 find -type f  -readable -size 1033c ! -executable

-type f – regular files only

-readable – file is readable by the current user

! -executable – not executable

-size 1033c – file size is exactly 1033 bytes (suffix c = bytes)

owned by user bandit7
owned by group bandit6
33 bytes in size

find / -type f -user bandit7 -group bandit6 -size 33c 2>/dev/null

/ — search from the root of the filesystem (you can change this if you know the likely directory)

-type f — regular files

-user bandit7 — file is owned by user bandit7

-group bandit6 — file is owned by group bandit6

-size 33c — file size is exactly 33 bytes

2>/dev/null — suppress permission denied errors

bandit6@bandit:~$ find / -type f -user bandit7 -group bandit6 -size 33c 2>/dev/null
/var/lib/dpkg/info/bandit7.password
bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
[REDACTED]

bandit7@bandit:~$ ls
data.txt
bandit7@bandit:~$ cat data.txt | grep -ie millionth
millionth       [REDACTED]
bandit7@bandit:~$ grep -ie millionth data.txt
millionth       [REDACTED]
bandit7@bandit:~$

cat data.txt | grep -ie millionth

This command outputs the contents of the file data.txt.

| (pipe)

The pipe takes the output of the cat command and sends it as input to the next command (grep).

grep -ie millionth

grep is used to search for lines that match a pattern.

-i makes the search case-insensitive (Millionth, millionth, MILLIONTH, etc., will all match).

-e allows you to specify the pattern explicitly (millionth in this case).

grep -ie millionth data.txt

grep -ie millionth

grep is used to search for lines that match a pattern.

-i makes the search case-insensitive (Millionth, millionth, MILLIONTH, etc., will all match).

-e allows you to specify the pattern explicitly (millionth in this case).

 data.txt specifies the file on to which we are required to look for the pattern we want.

bandit8@bandit:~$ ls
data.txt
bandit8@bandit:~$ sort data.txt | uniq -c | grep " 1 "
[REDACTED]

sort data.txt

Sorts all lines alphabetically so duplicates are adjacent.

uniq -c

Counts the number of occurrences of each unique line.

grep " 1 "

Filters to show only lines that appear once. 

The password for the next level is stored in the file data.txt
in one of the few human-readable strings, preceded by several ‘=’
characters.

bandit9@bandit:~$ strings data.txt | grep  "=.*"
,k=?
@k*=
========== the
#e=in
g+=ypF
ea=+
K>=*<
========== password{k
=========== is
1R=j/
e=<2g%
+G/YD=
=wDk
=3?lOt
[REDACTED]
=D!f
H =sS

strings data.txt

Extracts human-readable strings from a binary file.

grep '=.*'

Filters lines that contain one or more = characters followed by other text (the likely format for the password).

bandit10@bandit:~$ ls
data.txt
bandit10@bandit:~$ cat data.txt | base64 -d
[REDACTED]
bandit10@bandit:~$

cat data.txt

This reads and prints the contents of the file data.txt to standard output.

| (pipe)

Takes the output of cat data.txt and passes it as input to the next command.

base64 -d

This decodes base64-encoded data.

-d stands for decode (same as --decode).

bandit11@bandit:~$ cat data.txt | tr 'A-Za-z' 'N-ZA-Mn-za-m'
The password is [REDACTED]

tr = translate characters.

'A-Za-z' – the full alphabet (uppercase and lowercase).

'N-ZA-Mn-za-m' – the ROT13-shifted version.

This command replaces each letter with the one 13 positions later.

bandit12@bandit:~$ ls
data.txt
bandit12@bandit:~$ file data.txt
data.txt: ASCII text
bandit12@bandit:~$ cd /tmp
bandit12@bandit:/tmp$ mkdir n00b
bandit12@bandit:/tmp$ cd n00b
bandit12@bandit:/tmp/n00b$ cp /home/bandit12/data.txt .
bandit12@bandit:/tmp/n00b$ xxd -r data.txt > data.bin
bandit12@bandit:/tmp/n00b$ file data.bin
data.bin: gzip compressed data, was "data2.bin", last modified: Thu Apr 10 14:22:57 2025, max compression, from Unix, original size modulo 2^32 585
bandit12@bandit:/tmp/n00b$ mv data data.gz
bandit12@bandit:/tmp/n00b$ gunzip data.gz
bandit12@bandit:/tmp/n00b$ file data
data: POSIX tar archive (GNU)
bandit12@bandit:/tmp/n00b$ mv data data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar
bandit12@bandit:/tmp/n00b$ file data
data: cannot open `data' (No such file or directory)
bandit12@bandit:/tmp/n00b$ ls
data5.bin  data.tar  data.txt
bandit12@bandit:/tmp/n00b$ file data5.bin
data5.bin: POSIX tar archive (GNU)
bandit12@bandit:/tmp/n00b$ mv data5.bin data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar
bandit12@bandit:/tmp/n00b$ file data
data: cannot open `data' (No such file or directory)
bandit12@bandit:/tmp/n00b$ ls
data6.bin  data.tar  data.txt
bandit12@bandit:/tmp/n00b$ file data6.bin
data6.bin: bzip2 compressed data, block size = 900k
bandit12@bandit:/tmp/n00b$ mv data6.bin data.bz2
bandit12@bandit:/tmp/n00b$ bunzip2 data.bz2
bandit12@bandit:/tmp/n00b$ file data
data: POSIX tar archive (GNU)
bandit12@bandit:/tmp/n00b$ mv data data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar
bandit12@bandit:/tmp/n00b$ file data
data: cannot open `data' (No such file or directory)
bandit12@bandit:/tmp/n00b$ ls
data8.bin  data.tar  data.txt
bandit12@bandit:/tmp/n00b$ file data8.bin
data8.bin: gzip compressed data, was "data9.bin", last modified: Thu Apr 10 14:22:57 2025, max compression, from Unix, original size modulo 2^32 49
bandit12@bandit:/tmp/n00b$ mv data8.bin data.gz
bandit12@bandit:/tmp/n00b$ gunzip data.gz
bandit12@bandit:/tmp/n00b$ ls
data  data.tar  data.txt
bandit12@bandit:/tmp/n00b$ file data
data: ASCII text
bandit12@bandit:/tmp/n00b$ cat data
The password is [REDACTED]

bandit12@bandit:~$ ls
data.txt

bandit12@bandit:~$ file data.txt
data.txt: ASCII text

bandit12@bandit:/tmp$ mkdir n00b
bandit12@bandit:/tmp$ cd n00b

bandit12@bandit:/tmp/n00b$ cp /home/bandit12/data.txt .

bandit12@bandit:/tmp/n00b$ xxd -r data.txt > data.bin

bandit12@bandit:/tmp/n00b$ file data.bin
data.bin: gzip compressed data, was "data2.bin", last modified: ..., original size 585

bandit12@bandit:/tmp/n00b$ mv data data.gz
bandit12@bandit:/tmp/n00b$ gunzip data.gz

bandit12@bandit:/tmp/n00b$ file data
data: POSIX tar archive (GNU)

bandit12@bandit:/tmp/n00b$ mv data data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar

bandit12@bandit:/tmp/n00b$ ls
data5.bin  data.tar  data.txt

bandit12@bandit:/tmp/n00b$ file data5.bin
data5.bin: POSIX tar archive (GNU)

bandit12@bandit:/tmp/n00b$ mv data5.bin data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar

bandit12@bandit:/tmp/n00b$ ls
data6.bin  data.tar  data.txt

bandit12@bandit:/tmp/n00b$ file data6.bin
data6.bin: bzip2 compressed data, block size = 900k

bandit12@bandit:/tmp/n00b$ mv data6.bin data.bz2
bandit12@bandit:/tmp/n00b$ bunzip2 data.bz2

bandit12@bandit:/tmp/n00b$ file data
data: POSIX tar archive (GNU)

bandit12@bandit:/tmp/n00b$ mv data data.tar
bandit12@bandit:/tmp/n00b$ tar -xf data.tar

bandit12@bandit:/tmp/n00b$ ls
data8.bin  data.tar  data.txt

bandit12@bandit:/tmp/n00b$ file data8.bin
data8.bin: gzip compressed data, was "data9.bin", last modified: ..., original size 49

bandit12@bandit:/tmp/n00b$ mv data8.bin data.gz
bandit12@bandit:/tmp/n00b$ gunzip data.gz

bandit12@bandit:/tmp/n00b$ ls
data  data.tar  data.txt

bandit12@bandit:/tmp/n00b$ file data
data: ASCII text

bandit12@bandit:/tmp/n00b$ cat data
The password is [REDACTED]

#!/bin/bash
set -euo pipefail

# Check for required commands
for cmd in file xxd gunzip bunzip2 tar xzcat xz; do
  if ! command -v "$cmd" &>/dev/null; then
    echo "Error: required command '$cmd' not found."
    exit 1
  fi
done

WORKDIR=$(pwd)
filename="data.bin"

function cleanup {
  # Optional: cleanup temporary files if needed
  :
}
trap cleanup EXIT

while true; do
  if [[ ! -f "$filename" ]]; then
    echo "Error: file '$filename' not found."
    exit 1
  fi

  filetype=$(file -b "$filename")
  echo "[*] Current file ($filename) type: $filetype"

  case "$filetype" in

    *"gzip compressed data"*)
      newfile="data_$(date +%s).gz"
      mv "$filename" "$newfile"
      echo "[*] Decompressing gzip: $newfile"
      gunzip "$newfile"
      filename="${newfile%.gz}"
      ;;

    *"bzip2 compressed data"*)
      newfile="data_$(date +%s).bz2"
      mv "$filename" "$newfile"
      echo "[*] Decompressing bzip2: $newfile"
      bunzip2 "$newfile"
      filename="${newfile%.bz2}"
      ;;

    *"XZ compressed data"*)
      newfile="data_$(date +%s).xz"
      mv "$filename" "$newfile"
      echo "[*] Decompressing xz: $newfile"
      unxz "$newfile"
      filename="${newfile%.xz}"
      ;;

    *"POSIX tar archive"*)
      newfile="data_$(date +%s).tar"
      mv "$filename" "$newfile"
      echo "[*] Extracting tar archive: $newfile"
      mkdir -p extracted_$newfile
      tar -xf "$newfile" -C extracted_$newfile
      # Find biggest file in extracted directory
      nextfile=$(find extracted_$newfile -type f -exec ls -s {} + | sort -nr | head -n1 | awk '{print $2}')
      if [[ -z "$nextfile" ]]; then
        echo "[!] No files found inside the archive."
        exit 1
      fi
      filename="$nextfile"
      cd "$WORKDIR"  # make sure we stay in same dir
      echo "[*] Next file to process: $filename"
      ;;

    *"ASCII text"*)
      echo "[*] Found ASCII text file. Contents:"
      echo "---------------------------------------------------"
      cat "$filename"
      echo "---------------------------------------------------"
      echo "[*] Done."
      break
      ;;

    *)
      echo "[!] Unsupported or unknown file type: $filetype"
      echo "[!] Exiting."
      exit 1
      ;;
  esac
done

#!/bin/bash
set -euo pipefail

for cmd in file xxd gunzip bunzip2 tar xzcat xz; do
  if ! command -v "$cmd" &>/dev/null; then
    echo "Error: required command '$cmd' not found."
    exit 1
  fi
done

WORKDIR=$(pwd)
filename="data.bin"

function cleanup {
  :
}
trap cleanup EXIT

while true; do

if [[ ! -f "$filename" ]]; then
  echo "Error: file '$filename' not found."
  exit 1
fi

filetype=$(file -b "$filename")
echo "[*] Current file ($filename) type: $filetype"

*"gzip compressed data"*)
  ...

*"bzip2 compressed data"*)
  ...

*"XZ compressed data"*)
  ...

*"POSIX tar archive"*)
  ...

*"ASCII text"*)
  ...

*)
  echo "[!] Unsupported or unknown file type: $filetype"
  exit 1
  ;;

bandit13@bandit:~$ ssh -i sshkey.private bandit14@localhost -p 2220

ssh - Starts the Secure Shell (SSH) client. Used to connect to remote servers.

-i sshkey.private
Tells SSH to use the identity file (private key) sshkey.private for authentication. This file was provided in the level.

bandit14@localhost
Specifies the user (bandit14) and host (localhost) to connect to. localhost means "this machine" (i.e., you're logging into the same server you're already on, but as a different user).

-p 2220
Instructs SSH to connect using port 2220 instead of the default port 22. This is important for Bandit, since all levels use port 2220.

bandit14@bandit:~$ cat /etc/bandit_pass/bandit14 | nc localhost 30000
Correct!
[REDACTED]

cat /etc/bandit_pass/bandit14 reads your current level's password.

| pipes it as input into…

nc localhost 30000 which sends it to port 30000 on the local machine.

bandit15@bandit:~$ cat /etc/bandit_pass/bandit15 | ncat --ssl localhost 30001
Correct!
[REDACTED]

 cat /etc/bandit_pass/bandit15

Purpose: Reads the contents of the file that holds the current level's password (for bandit15).

This password is needed to authenticate and retrieve the next level’s password.

 |

The pipe (|) takes the output of the cat command (the password) and sends it as input to the next command (ncat).

 ncat --ssl localhost 30001

ncat: A modern version of netcat (from the Nmap project). It allows data to be sent or received over the network.

--ssl: Enables SSL/TLS encryption for secure communication.

localhost: Refers to the current machine (i.e., you're connecting to a service running locally).

30001: The port number on localhost that is listening for incoming SSL connections.

bandit16@bandit:~$ nmap localhost -p 31000-32000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-06-04 08:44 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT      STATE SERVICE
31046/tcp open  unknown
31518/tcp open  unknown
31691/tcp open  unknown
31790/tcp open  unknown
31960/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds

bandit16@bandit:~$ nmap localhost -A -p 31000-32000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-06-04 08:48 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00011s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT      STATE SERVICE     VERSION
31046/tcp open  echo
31518/tcp open  ssl/echo
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=SnakeOil
| Not valid before: 2024-06-10T03:59:50
|_Not valid after:  2034-06-08T03:59:50
31691/tcp open  echo
31790/tcp open  ssl/unknown
| ssl-cert: Subject: commonName=SnakeOil
| Not valid before: 2024-06-10T03:59:50
|_Not valid after:  2034-06-08T03:59:50
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings:
|   FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, LPDString, RTSPRequest, SIPOptions:
|_    Wrong! Please enter the correct current password.
31960/tcp open  echo
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31790-TCP:V=7.94SVN%T=SSL%I=7%D=6/4%Time=68400869%P=x86_64-pc-linux
SF:-gnu%r(GenericLines,32,"Wrong!\x20Please\x20enter\x20the\x20correct\x20
SF:current\x20password\.\n")%r(GetRequest,32,"Wrong!\x20Please\x20enter\x2
SF:0the\x20correct\x20current\x20password\.\n")%r(HTTPOptions,32,"Wrong!\x
SF:20Please\x20enter\x20the\x20correct\x20current\x20password\.\n")%r(RTSP
SF:Request,32,"Wrong!\x20Please\x20enter\x20the\x20correct\x20current\x20p
SF:assword\.\n")%r(Help,32,"Wrong!\x20Please\x20enter\x20the\x20correct\x2
SF:0current\x20password\.\n")%r(FourOhFourRequest,32,"Wrong!\x20Please\x20
SF:enter\x20the\x20correct\x20current\x20password\.\n")%r(LPDString,32,"Wr
SF:ong!\x20Please\x20enter\x20the\x20correct\x20current\x20password\.\n")%
SF:r(SIPOptions,32,"Wrong!\x20Please\x20enter\x20the\x20correct\x20current
SF:\x20password\.\n");

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 161.57 seconds

bandit16@bandit:~$ cat /etc/bandit_pass/bandit16 | ncat --ssl localhost 31790
Correct!
-----BEGIN RSA PRIVATE KEY-----
[REDACTED]
-----END RSA PRIVATE KEY-----

chmod 400 key

where  
4 = owner can read
0 = group has no permission
0 = others have no permission

ssh -i key bandit17@bandit.labs.overthewire.org -p 2220

bandit17@bandit:~$ diff passwords.old passwords.new
42c42
< [REDACTED]
---
> [REDACTED]

breakdown

diff: A Linux command that compares files and outputs the lines that differ.

passwords.old: The first file, presumably containing older password data.

passwords.new: The second file, presumably containing updated password data.

       -t      Force pseudo-terminal allocation.  This can be used to execute arbitrary screen-based programs on  a  remote  ma‐
               chine, which can be very useful, e.g. when implementing menu services.  Multiple -t options force tty allocation,
               even if ssh has no local tty.

ssh -t bandit18@bandit.labs.overthewire.org -p 2220 /bin/sh

breakdown

ssh: This is the Secure Shell command, used to remotely log into another machine over the network.

-t: This forces pseudo-terminal allocation. It allows you to run commands that require a terminal (like interactive shells). Even if a command is given directly (like /bin/sh), -t ensures it gets a proper terminal session.

bandit18@bandit.labs.overthewire.org:

bandit18 — the username you're logging in with.

bandit.labs.overthewire.org — the host/domain of the remote server.

-p 2220: Specifies the port number for SSH, which is 2220 (instead of the default 22).

/bin/sh: This is the command to run once you're logged in — it directly invokes the sh shell on the remote system.

bandit19@bandit:~$ ls
bandit20-do
bandit19@bandit:~$ ./bandit20-do
Run a command as another user.
  Example: ./bandit20-do id
bandit19@bandit:~$

bandit19@bandit:~$ ./bandit20-do cat /etc/bandit_pass/bandit20
[READCTED]
bandit19@bandit:~$

#Terminal 1 pass the password for bandit20 through port <port of your choice>

bandit20@bandit:~$ nc -lp 31337 < /etc/bandit_pass/bandit20
[next level password as output]

#Terminal 2 listen on the port where th epassword has been passed from

bandit20@bandit:~$ ./suconnect 31337
Read: [Initial password level passed and read]
Password matches, sending next password

bandit21@bandit:~$ ls -la /etc/cron.d
total 48
drwxr-xr-x   2 root root  4096 Apr 10 14:24 .
drwxr-xr-x 121 root root 12288 Apr 21 12:42 ..
-rw-r--r--   1 root root   123 Apr 10 14:16 clean_tmp
-rw-r--r--   1 root root   120 Apr 10 14:23 cronjob_bandit22
-rw-r--r--   1 root root   122 Apr 10 14:23 cronjob_bandit23
-rw-r--r--   1 root root   120 Apr 10 14:23 cronjob_bandit24
-rw-r--r--   1 root root   201 Apr  8  2024 e2scrub_all
-rwx------   1 root root    52 Apr 10 14:24 otw-tmp-dir
-rw-r--r--   1 root root   102 Mar 31  2024 .placeholder
-rw-r--r--   1 root root   396 Jan  9  2024 sysstat
bandit21@bandit:~$ cat /etc/cron.d/cronjob_bandit22
@reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
* * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null
bandit21@bandit:~$ cat /usr/bin/cronjob_bandit22.sh
#!/bin/bash
chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
bandit21@bandit:~$ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
[REDACTED]

#!/bin/bash
chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
#!/bin/bash

Breakdown

This is a shebang line.

It tells the system to execute the script using the Bash shell (/bin/bash).

chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

chmod 644 sets the file permissions on the given file.

6 = read + write for owner

4 = read-only for group

4 = read-only for others

So, the file becomes world-readable, which means any user on the system can read it.

cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv

This uses cat to read the contents of the password file for bandit22.

The output is redirected (>) into the temporary file /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv.

bandit22@bandit:~$ ls -la /etc/cron.d
total 48
drwxr-xr-x   2 root root  4096 Apr 10 14:24 .
drwxr-xr-x 121 root root 12288 Apr 21 12:42 ..
-rw-r--r--   1 root root   123 Apr 10 14:16 clean_tmp
-rw-r--r--   1 root root   120 Apr 10 14:23 cronjob_bandit22
-rw-r--r--   1 root root   122 Apr 10 14:23 cronjob_bandit23
-rw-r--r--   1 root root   120 Apr 10 14:23 cronjob_bandit24
-rw-r--r--   1 root root   201 Apr  8  2024 e2scrub_all
-rwx------   1 root root    52 Apr 10 14:24 otw-tmp-dir
-rw-r--r--   1 root root   102 Mar 31  2024 .placeholder
-rw-r--r--   1 root root   396 Jan  9  2024 sysstat
bandit22@bandit:~$ cat /etc/cron.d/cronjob_bandit23
@reboot bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
* * * * * bandit23 /usr/bin/cronjob_bandit23.sh  &> /dev/null
bandit22@bandit:~$ cat /usr/bin/cronjob_bandit23.sh
#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget

#!/bin/bash

myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget

Breakdown

🔍 Line-by-Line Explanation
#!/bin/bash

The shebang line — tells the system to use the Bash shell to interpret the script.

myname=$(whoami)

Runs the whoami command to get the current username, and saves it in the variable myname.

mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

This line creates a hashed target filename:

echo I am user $myname: creates the string I am user banditXX (if you're bandit20, it'll say I am user bandit20)

| md5sum: pipes that string into md5sum, producing a hash

| cut -d ' ' -f 1: trims the output to only the hash (since md5sum outputs both the hash and a dash -)

Result: You now have a unique hash value stored in mytarget, which will be used as a filename.

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

Just prints a message like: Copying passwordfile /etc/bandit_pass/bandit20 to /tmp/94f93cbfe0e106a7e6bffa548f2d8a4d

cat /etc/bandit_pass/$myname > /tmp/$mytarget

Uses cat to read the contents of the password file for the current user (/etc/bandit_pass/bandit20 if you're bandit20).

Redirects (>) that output to the /tmp folder under the hashed filename.

bandit22@bandit:~$ echo "I am user bandit23" | md5sum
8ca319486bfbbc3663ea0fbe81326349  -
bandit22@bandit:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349
[REDACTED]

bandit23@bandit:~$ cat /usr/bin/cronjob_bandit24.sh
#!/bin/bash

myname=$(whoami)

cd /var/spool/$myname/foo
echo "Executing and deleting all scripts in /var/spool/$myname/foo:"
for i in * .*;
do
    if [ "$i" != "." -a "$i" != ".." ];
    then
        echo "Handling $i"
        owner="$(stat --format "%U" ./$i)"
        if [ "${owner}" = "bandit23" ]; then
            timeout -s 9 60 ./$i
        fi
        rm -f ./$i
    fi
done

This Bash script is designed to execute and delete all scripts in a directory, with some checks for file ownership and a timeout. It’s likely part of a challenge like Bandit Level 24 → 25, where your script is automatically executed if you drop it in the right place with the right ownership.

🔍 Full Breakdown
#!/bin/bash

The shebang tells the system to use Bash to run the script.

myname=$(whoami)

Stores the current username in the variable myname.

cd /var/spool/$myname/foo

Changes the current working directory to /var/spool/<username>/foo.

For example, if whoami is bandit24, this becomes /var/spool/bandit24/foo.

echo "Executing and deleting all scripts in /var/spool/$myname/foo:"

Just a status message to indicate what the script is doing.

🔁 Loop
for i in * .*;

Iterates over all files, including hidden ones (.*).

Typical globbing (*) misses dotfiles (like .my_script), so both patterns are used to catch everything.

if [ "$i" != "." -a "$i" != ".." ];

Skips the special entries . (current directory) and .. (parent directory), which would break the script if processed.

echo "Handling $i"

Prints the filename being processed.

owner="$(stat --format "%U" ./$i)"

Uses stat to get the owner of the file (%U is the user name), and stores it in owner.

if [ "${owner}" = "bandit23" ]; then
    timeout -s 9 60 ./$i
fi

If the file is owned by bandit23, the script:

Runs the file using timeout:

-s 9: sends SIGKILL (signal 9) if it runs too long.

60: gives it 60 seconds max to run.

Prevents scripts from hanging or consuming too many resources.

rm -f ./$i

Deletes the script file after executing (regardless of ownership or execution success).

bandit23@bandit:~$ myname=bandit24
bandit23@bandit:~$ $myname
bandit24: command not found
bandit23@bandit:~$

bandit23@bandit:~$ mkdir /tmp/victor
bandit23@bandit:~$ chmod 777 /tmp/victor
bandit23@bandit:~$

bandit23@bandit:~$ cd /var/spool/$myname
bandit23@bandit:/var/spool/bandit24$ ls
foo
bandit23@bandit:/var/spool/bandit24$ cd foo
bandit23@bandit:/var/spool/bandit24/foo$

#!/usr/bin/bash

cat /etc/bandit_pass/bandit24 > /tmp/victor/pass.txt

bandit23@bandit:/var/spool/bandit24/foo$ nano get.sh
Unable to create directory /home/bandit23/.local/share/nano/: No such file or directory
It is required for saving/loading search history or cursor positions.

bandit23@bandit:/var/spool/bandit24/foo$ chmod +x get.sh
bandit23@bandit:/var/spool/bandit24/foo$

bandit23@bandit:/var/spool/bandit24/foo$ ls /tmp/victor
pass.txt
bandit23@bandit:/var/spool/bandit24/foo$ cat /tmp/victor/pass.txt
[REDACTED]

#!/usr/bin/env bash
# Shebang line tells the system to use the Bash shell via the env command (more portable than /bin/bash)

# Loop through numbers 0000 to 9999 (4-digit PINs, zero-padded)
for i in $(seq -w 0 9999); do #The seq command in Linux/Unix is used to generate a sequence of numbers
    # For each PIN, print the password followed by the current PIN (e.g., "password 0001")
    echo "[redacted] $i"
done | nc localhost 30002
# Send all generated lines to the daemon listening on port 30002 using netcat (nc)
# This avoids reconnecting for each PIN attempt — the daemon stays connected for the whole brute-force process

bandit2:x:11002:11002:bandit level 2:/home/bandit2:/bin/bash
bandit20:x:11020:11020:bandit level 20:/home/bandit20:/bin/bash
bandit21:x:11021:11021:bandit level 21:/home/bandit21:/bin/bash
bandit22:x:11022:11022:bandit level 22:/home/bandit22:/bin/bash
bandit23:x:11023:11023:bandit level 23:/home/bandit23:/bin/bash
bandit24:x:11024:11024:bandit level 24:/home/bandit24:/bin/bash
bandit25:x:11025:11025:bandit level 25:/home/bandit25:/bin/bash
bandit26:x:11026:11026:bandit level 26:/home/bandit26:/usr/bin/showtext => for this user the shell is of type /usr/bin/showtext
bandit27:x:11027:11027:bandit level 27:/home/bandit27:/bin/bash
bandit28:x:11028:11028:bandit level 28:/home/bandit28:/bin/bash
bandit29:x:11029:11029:bandit level 29:/home/bandit29:/bin/bash

bandit25@bandit:~$ cat /usr/bin/showtext
#!/bin/sh

export TERM=linux

exec more ~/text.txt
exit 0

       =
           Display current line number.

       /pattern
           Search for kth occurrence of regular expression. Defaults to 1.

       n
           Search for kth occurrence of last regular expression. Defaults to 1.

       !command or :!command
           Execute command in a subshell.

       v
           Start up an editor at current line. The editor is taken from the environment variable
           VISUAL if defined, or EDITOR if VISUAL is not defined, or defaults to vi(1) if neither
           VISUAL nor EDITOR is defined.

 GIT_SSH_COMMAND="ssh -p 2220" git clone ssh://bandit27-git@localhost/home/bandit27-git/repo

 GIT_SSH_COMMAND="ssh -p 2220"

This sets an environment variable for the Git command.

It tells Git:

"When using SSH to connect, use the command ssh -p 2220 instead of the default SSH (which uses port 22)."

This is important because the Bandit SSH server listens on port 2220, not 22.

git clone ssh://bandit27-git@localhost/home/bandit27-git/repo

This tells Git to clone a repository using the SSH protocol.

bandit27-git@localhost means:

Connect as user bandit27-git to the local machine (because you're already on the Bandit server).

/home/bandit27-git/repo is the path to the Git repository on the server.

So what happens together?
Git uses the custom SSH command (ssh -p 2220) to:

Connect to localhost on port 2220

Authenticate as bandit27-git

Clone the Git repo from /home/bandit27-git/repo

 GIT_SSH_COMMAND="ssh -p 2220" git clone ssh://bandit28-git@localhost/home/bandit28-git/repo

bandit28@bandit:/tmp/28o/repo$ cat README.md
# Bandit Notes
Some notes for level29 of bandit.

## credentials

- username: bandit29
- password: xxxxxxxxxx

bandit28@bandit:/tmp/28o/repo$ git log
commit 674690a00a0056ab96048f7317b9ec20c057c06b (HEAD -> master, origin/master, origin/HEAD)
Author: Morla Porla <morla@overthewire.org>
Date:   Thu Apr 10 14:23:19 2025 +0000

    fix info leak

commit fb0df1358b1ff146f581651a84bae622353a71c0
Author: Morla Porla <morla@overthewire.org>
Date:   Thu Apr 10 14:23:19 2025 +0000

    add missing data

commit a5fdc97aae2c6f0e6c1e722877a100f24bcaaa46
Author: Ben Dover <noone@overthewire.org>
Date:   Thu Apr 10 14:23:19 2025 +0000

    initial commit of README.md

bandit28@bandit:/tmp/28o/repo$ git checkout fb0df1358b1ff146f581651a84bae622353a71c0
Note: switching to 'fb0df1358b1ff146f581651a84bae622353a71c0'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at fb0df13 add missing data
bandit28@bandit:/tmp/28o/repo$ git status
HEAD detached at fb0df13
nothing to commit, working tree clean
bandit28@bandit:/tmp/28o/repo$ cat README.md
# Bandit Notes
Some notes for level29 of bandit.

## credentials

- username: bandit29
- password: [redacted]