Description

Instead of a password file, the home directory contains sshkey.private - an RSA private key for bandit14. Use it to log in as bandit14, then read the password file.

Overview

• SSH supports key-based authentication with a public/private key pair.
• The -i flag specifies the identity (private key) file to use.
• The private key avoids password authentication entirely.

Solution

Step 1: Copy the Private Key

channel = connect.system("cat sshkey.private")
key_data = channel.recv().decode().strip()
with open("bandit14-sshkey.private", "w") as f:
    f.write(key_data)

Step 2: Log in as bandit14

connect14 = pwn.ssh(host=hostname, user="bandit14", port=2220, keyfile="bandit14-sshkey.private")
channel = connect14.system("cat /etc/bandit_pass/bandit14")
result = channel.recv().decode().strip()

Password

fGrHPx402xGC7U7rXKDaxiWFTOiF0ENq