Logo
Published on
views

Bandit 32 Writeup

Authors
  • Name
    Pablo
    Twitter
    @pablousu
  • Name
    Maylen Echavez
    Twitter
Table of Contents

bandit 32

Task

After all this git stuff, it’s time for another escape. Good luck!

Solution

Certainly! Here's a more detailed description of the steps and commands used to navigate and solve the problem:

  1. Initial Shell Exploration: Upon entering the shell, you encounter restricted permissions when trying to list files (ls command):

    >> ls
    sh: 1: LS: Permission denied
    

    It appears that all input is being converted to uppercase, which restricts your ability to execute certain commands normally.

  2. Exiting and Reviewing User Information: You decide to exit back to the previous level (bandit 32) to gather more information about the user:

    bandit32:x:11032:11032:bandit level 32:/home/bandit32:/home/bandit32/uppershell
    

    From this output, you learn that the home directory for bandit 32 is /home/bandit32 and there's a directory named /home/bandit32/uppershell.

  3. Re-entering the Shell and Changing to Bash: You return to bandit 32 and attempt to spawn a bash shell using the $0 command, which starts a new instance of the current shell with bash:

    >> $0
    $
    

    Now you're in a new bash shell ($ prompt).

  4. Finding the Password for Bandit 33: In this new bash shell, you navigate to the directory containing the password file for bandit 33 (/etc/bandit_pass/bandit33) and use cat to read its contents:

    $ cat /etc/bandit_pass/bandit33
    odHo63fHiFqcWWJG9rLiLDtPm45KzUKy
    

    Here, you find the password for bandit 33: odHo63fHiFqcWWJG9rLiLDtPm45KzUKy.

  5. Conclusion: With the password obtained, you can now proceed to log in as bandit 33 (ssh bandit33@hostname) using the password odHo63fHiFqcWWJG9rLiLDtPm45KzUKy.

This detailed explanation walks through the steps of accessing and navigating within the restricted shell environment, leveraging $0 to switch to a more functional bash shell, and finally retrieving the password needed to progress to the next level.