Description

suconnect is a setuid binary that opens a TCP connection to a given port on localhost. If the current bandit20 password is sent back, it replies with the bandit21 password. The goal is to set up a listener that sends the current password and receives the next one.

Overview

• Two simultaneous SSH sessions (or background processes) are needed: one running nc -l as a listener, one running suconnect.
• The listener sends the current password when suconnect connects; suconnect verifies it and replies with the next password.

Solution

port = 3903

# Session 1: start listener, send current password
channel1 = ssh1.system(f"nc -l {port}")
channel1.sendline(current_password.encode())

# Session 2: run suconnect to connect to the listener
channel2 = ssh2.system(f"./suconnect {port}")

# Receive upgraded password from listener session
result = channel1.recv().decode().strip()

Password

NvEJF7oVjkddltPSrdKEFOllh9V1IBcq