Description

The home directory has an SSH key for bandit26, but bandit26’s login shell is /usr/bin/showtext, which runs more on a short text file and then exits. The goal is to escape from more into a real shell.

Overview

• more enters interactive mode only if the content is longer than the terminal height.
• Shrinking the terminal window before connecting forces more to pause.
• From more’s interactive mode, pressing v opens the file in vi/vim.
• Inside vim, :set shell=/bin/bash followed by :shell spawns a bash shell inheriting bandit26’s privileges.

Solution

Step 1: Shrink the Terminal

• Resize the terminal to fewer rows than the content of text.txt (about 6 lines).
• This forces more into interactive mode when connecting.

Step 2: Enter Vim from more

• When more pauses at --More--, press v to open the file in vim.

Step 3: Escape to Bash

:set shell=/bin/bash
:shell

Step 4: Read the Password

cat /etc/bandit_pass/bandit26

Password

c7GvcKlw9mC7aUQaPx7nwFstuAIBw1o1