Bandit Level 12 → 13

Goal:

The password for level 13 is hidden in data.txt, but it’s hexdumped and repeatedly compressed. So the goal is to decode and unpack it layer by layer until we reach the password.

Step 1: Make a safe working directory

We don’t want to clutter /tmp, so we create a temporary directory using mktemp:

mktemp -d /tmp/level12to13.XXXX

• This makes a directory like /tmp/level12to13.lDkL
• Then copy the data file there:

cp ~/data.txt /tmp/level12to13.lDkL
cd /tmp/level12to13.lDkL
mv data.txt decodeddatat.txt

Step 2: Convert the hexdump back into a binary file

data.txt is a hex dump. Use xxd to reverse it:

xxd -r decodeddatat.txt > binary_data

Check the file type:

file binary_data

• The first layer is gzip: gzip compressed data.
• Rename and unpack it:

mv binary_data binary_data.gz
gunzip binary_data.gz

Step 3: Unpack multiple compression layers

After gunzip, binary_data was a bzip2 archive:

file binary_data  # shows bzip2
mv binary_data binary_data.bz2
bunzip2 binary_data.bz2

• Then it became a tar archive:

file binary_data  # POSIX tar archive
mv binary_data binary_data.tar
tar -xf binary_data.tar

• This gave data5.bin.

Step 4: Keep unpacking nested archives

• data5.bin → tar → data6.bin
• data6.bin → tar → data8.bin
• data8.bin → gzip → data9.bin

Check each file with file <filename> to see the type (gzip, bzip2, tar). Rename appropriately and unpack:

mv data8.bin data8.gz
gunzip data8.gz

Step 5: Read the password

After unpacking all the layers:

cat data8

Output:

The password is FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn

✅ That’s the password for Bandit Level 13.

Summary:

1. data.txt is a hexdump → convert to binary using xxd -r.
2. File is repeatedly compressed → use file to check each layer.
3. Unpack layer by layer using gunzip, bunzip2, or tar -xf.
4. Keep going until you see readable text → that’s the password.