Description

After escaping bandit26’s restricted shell (see level 25), a setuid binary bandit27-do is in the home directory. It runs commands as bandit27. Use it to read the next password.

Overview

• From inside the vim escape (:shell with /bin/bash), bandit26’s home directory is accessible.
• bandit27-do is setuid to bandit27; passing cat /etc/bandit_pass/bandit27 reads the next password.

Solution

# Inside the shell obtained from bandit25 escape:
./bandit27-do cat /etc/bandit_pass/bandit27

Password

YnQpBuifNMas1hcUFk70ZmqkhUU2EuaS