Bandit Level 13 → 14

Goal

Use the private SSH key in the home directory to log in to bandit14 on localhost.

Why this matters

Key-based authentication separates possession of a private key from knowledge of a password.

Progressive hints

1. Hint 1

   Inspect the key permissions before use.

2. Hint 2

   SSH accepts an identity file with -i.

3. Hint 3

   The destination is the same game host through localhost and its SSH port.

Method

Run only the lines that match the evidence you observe.

ls -l sshkey.private
ssh -i sshkey.private bandit14@localhost -p 2220

Expected non-secret observation

SSH accepts the supplied identity and opens a shell as the destination account without exposing a password here.

Explanation

The client proves possession of the private key; the server validates it against the account's authorized public key.

Troubleshooting

• Use the exact key path and destination user.
• If SSH rejects permissive key permissions on a local copy, restrict that copy with chmod 600.

Safety and cleanup

• Use only the OverTheWire game host and your own local practice directory.
• Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
• Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 14 login. Then mark this transition complete and continue.