Description

The home directory contains a setuid binary bandit20-do. It runs commands as bandit20. Use it to read bandit20’s password file.

Overview

• A setuid binary executes with the file owner’s privileges rather than the caller’s.
• Running ./bandit20-do id shows the effective user is bandit20.
• Passing cat /etc/bandit_pass/bandit20 reads the protected password file.

Solution

channel = connect.system("./bandit20-do cat /etc/bandit_pass/bandit20")
result = channel.recv().decode().strip()

Password

VxCazJaVykI6W36BkBU0mJTCM8rR95XT