Wargame Walkthrough: Bandit Level 4

This is a walkthrough to the bandit wargame made by OverTheWire. It can be found on their website at https://overthewire.org/wargames/bandit

Level 4

Goals: find the password for the next level and log in as the next user (I should stop putting this because it is the same every time)
Given information: The password is in the only human-readable file in the readme folder.

After logging in we can do some snooping and see that there is an inhere folder in the root directory, as can be expected. We navigate in here and list all files and see that there are 10 files, named ‘-file0[0-9]’. Now at this point, we could use cat to print out every file one by one, but as we know that only one of these files is readable, that would print a whole lot of stuff we didn’t want onto our terminal and we would keep having to use ‘clear’ to clean it up. Plus that would take a while and no one has time for all that. (Comment below if you actually did all that.) Instead we are going to use a nifty little command called ‘file’. This command prints out the file type of the file you specify. (Format: ‘file [filename]’) Now this command can easily tell us which file has the readable text.

To do this we could use the command individually on each file, but again, no one has time for all that. So let’s see if we can streamline the process.

The asterisk is a super useful key we can use to represent any and all (kinda like a wild card). So let’s try ‘file *’. If you have been following along you will see that it gives a whole slew of errors:

This is puzzling. From closer examination we can see that the file command was looking for files named ‘ile0[0-9]’ instead of the -file0[0-9]’ we wanted it to. This is because the asterisk turns the command into multiple commands, plugging in every file in the directory as the asterisk (‘file -file00’, ‘file -file01’, etc). The error was caused by the dashes in the filename. In Linux, dashes precede arguments, which we have used in the past (‘ls -la’). For this reason the file command was taking the -f as an argument and instead searching for files named ‘ile0[0-9]’. To combat this, we can simply use the same trick we used on the level with the dashed filename. We can use the ‘./’ to specify that the ‘-f’ is part of the filename. Now when we try ‘file ./*’ we will get the results we want:

This shows us quite nicely which file we want to open. We can open using the ‘cat’ command, taking care to specify that the dash is in the filename again, and we get our password.

Copy this into your stored passwords file and you are ready to move on to the next level!

This wargame can be found on https://overthewire.org/wargames/bandit
Check them out for more wargames and the rest of the levels.