Description

.bashrc has been modified to run exit immediately, so interactive SSH sessions terminate right away. The password is in readme in the home directory.

Overview

• SSH allows passing a command directly: ssh user@host command runs the command without starting an interactive shell.
• This bypasses .bashrc because the login shell is not interactive.
• Alternatively, ssh -t forces a pseudo-TTY, or ssh -T suppresses the PTY entirely.

Solution

connect = pwn.ssh(host=hostname, user="bandit18", password=password, port=2220)
channel = connect.system("cat readme")
result = channel.recv().decode().strip()

Password

awhqfNnAbc1naukrpqDYcF95h7HoMTrC