Wargame: Bandit
Level: 2
Category: Linux Fundamentals
Description
The password is stored in a file named spaces in this filename in the home directory. Passing the name unquoted to cat splits it into separate arguments.
Overview
- Spaces in filenames are word-splitting characters for the shell.
- Quoting the name (
"spaces in this filename") or escaping each space (spaces\ in\ this\ filename) passes it as a single argument.
Solution
- Quote the filename to prevent word splitting.
channel = connect.system('cat "spaces in this filename"')
result = channel.recv().decode().strip()
Password
aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG