Goal
There is a setuid binary in your home directory.
Run it (without arguments) to learn how to use it. After using it correctly, you can read the next password from the usual place (/etc/bandit_pass).
Hints
- “setuid” means the program runs with the file owner’s privileges (not yours).
- Start by listing files and checking permissions (look for an
sin the execute bit). - Always run unknown binaries with
./<name>and read the usage text first.
Solution (click to reveal)
- SSH in:
ssh bandit20@bandit.labs.overthewire.org -p 2220
- List files and identify the setuid binary:
ls -la
- Run it with no args to see usage:
./bandit20-do
- Use it to run
catas the privileged user:
./bandit20-do cat /etc/bandit_pass/bandit20
The output is the password for Level 21.
Notes
- You’re not “escalating” globally—only the command you run via the helper gets those privileges.