tutorial · bandit

Bandit Level 21

Use a setuid connector binary + a local listener to receive the next password.

banditsetuidnclocalhost

Optional narration

Marks this level complete in your browser.

Goal

There is a setuid binary in your home directory that:

connects to localhost:<port-you-supply>
reads one line from that connection
compares it to the previous password (bandit20)
if correct, sends back the password for bandit21

Hints

You need two terminals (or run one command in the background).
One terminal runs a listener (server) with nc -l.
The other terminal runs the setuid binary pointing at that listener.

Solution (click to reveal)

SSH in:

ssh bandit21@bandit.labs.overthewire.org -p 2220

In terminal A, start a listener on some high port (example 44444):

nc -l 44444

In terminal B (another SSH session), run the setuid program and point it at your listener port:

./suconnect 44444

Now go back to terminal A (the listener). Paste the bandit20 password and press Enter.

The setuid binary should send back the password for Level 22.

Notes

If nc -l syntax differs, try nc -l -p 44444.
If you only have one terminal, you can background the listener: nc -l 44444 & (then jobs, fg to bring it back).

← Bandit Level 20 Bandit Level 22 →