Goal
There is a setuid binary in your home directory that:
- connects to
localhost:<port-you-supply> - reads one line from that connection
- compares it to the previous password (bandit20)
- if correct, sends back the password for bandit21
Hints
- You need two terminals (or run one command in the background).
- One terminal runs a listener (server) with
nc -l. - The other terminal runs the setuid binary pointing at that listener.
Solution (click to reveal)
- SSH in:
ssh bandit21@bandit.labs.overthewire.org -p 2220
- In terminal A, start a listener on some high port (example 44444):
nc -l 44444
- In terminal B (another SSH session), run the setuid program and point it at your listener port:
./suconnect 44444
- Now go back to terminal A (the listener). Paste the bandit20 password and press Enter.
The setuid binary should send back the password for Level 22.
Notes
- If
nc -lsyntax differs, trync -l -p 44444. - If you only have one terminal, you can background the listener:
nc -l 44444 &(thenjobs,fgto bring it back).