Bandit Level 19 → 20

Goal

Use the setuid binary in the home directory to read the next level's password.

Why this matters

Setuid programs illustrate how a process can run with an effective identity different from its caller—and why such binaries need strict design.

Progressive hints

1. Hint 1

   Inspect the permission bits and owner.

2. Hint 2

   Run the helper without arguments to learn its contract.

3. Hint 3

   Use it only for the official read operation.

Method

Run only the lines that match the evidence you observe.

ls -l
./bandit20-do
./bandit20-do cat /etc/bandit_pass/bandit20

Expected non-secret observation

The helper executes the requested command with its configured effective user and prints the game credential.

Explanation

The setuid bit lets the binary adopt its owner's effective UID; the helper passes the requested command through that privilege boundary.

Troubleshooting

• Use ./ so the shell runs the local binary.
• Recheck the destination account name in the official goal.

Safety and cleanup

• Use only the OverTheWire game host and your own local practice directory.
• Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
• Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 20 login. Then mark this transition complete and continue.