Bandit Level 20

Goal

There is a setuid binary in your home directory.

Run it (without arguments) to learn how to use it. After using it correctly, you can read the next password from the usual place (/etc/bandit_pass).

Hints

“setuid” means the program runs with the file owner’s privileges (not yours).
Start by listing files and checking permissions (look for an s in the execute bit).
Always run unknown binaries with ./<name> and read the usage text first.

Solution (click to reveal)

SSH in:

ssh bandit20@bandit.labs.overthewire.org -p 2220

List files and identify the setuid binary:

ls -la

Run it with no args to see usage:

./bandit20-do

Use it to run cat as the privileged user:

./bandit20-do cat /etc/bandit_pass/bandit20

The output is the password for Level 21.

Notes

You’re not “escalating” globally—only the command you run via the helper gets those privileges.