Wargame: Bandit
Level: 3
Category: Linux Fundamentals
Description
The password is in a hidden file inside the inhere directory. On Unix, files whose names start with . are hidden from plain ls output.
Overview
ls -aorls -lareveals hidden files (dotfiles).- Hidden files are a convention, not a security mechanism; any user with read permission on the directory can see and read them.
Solution
- Navigate to
inhereand list all files including hidden ones.
channel = connect.system("ls -la inhere")
files = channel.recv().decode().strip().split("\n")[3:] # skip . and ..
hidden = [f.split()[-1] for f in files][0]
channel = connect.system(f"cat inhere/{hidden}")
result = channel.recv().decode().strip()
Password
2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe