Bandit27
Bandit Level 27 — you already have a shell as bandit26; use a setuid helper in its home directory to read the next password.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
Level Goal
Good job getting a shell! Now hurry and grab the password for bandit27!
Commands you may need to solve this level
ls
Study guide
Level map: logged in as bandit26, find the password for bandit27.
What this level teaches
Recognising a pattern you have met before: the setuid binary from Level 20 again, this time as your route to the next user.
Key ideas
- Reuse patterns. After a hard level, the follow-up can be easy, provided you recognise what you are looking at.
ls -lshows ansin the permissions of a setuid file and who owns it.- How the helper behaves. Run it with no arguments to see what it expects.
How to approach it
- List your home directory and spot the setuid program.
- Work out, from its usage message, how to make it act as
bandit27on your behalf. - Use it to read the file in
/etc/bandit_pass.
Why it matters
Mature administrators know “how do I run one command as another user” by heart: sudo, setuid helpers and su all follow the same idea.