Concepts to consider

A concept to consider here is setuid, this concept is explained in last bandits rooms

bandit 26

Task

Good job getting a shell! Now hurry and grab the password for bandit27!

Solution

Within Vim, we can execute commands using :terminal. We run :terminal ls and get the output: bandit27-do text.txt Additionally, using :terminal file bandit27 we see:

bandit27-do: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=037b97b430734c79085a8720c90070e346ca378e, for GNU/Linux 3.2.0, not stripped

Let's see what bandit27-do does:

Run a command as another user.
  Example: ./bandit27-do id

We execute: :terminal ./bandit27-do cat /etc/bandit_pass/bandit27 Resulting in: YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS