Bandit 20 → 21

OverTheWire Linux Progressive

Goal: get the next password from a setuid program that connects to a port and checks what it reads against the current password.

Approach

Background a one-shot listener that prints the current password, then point the setuid client at that port.

bandit20@bandit

bandit20@bandit:~$ echo "<password>" | nc -lp 1337 &
[1] 2478116
bandit20@bandit:~$ ./suconnect 1337
Read: <password>
Password matches, sending next password
The password you are looking for is: <password>

PasswordEeoULMCra2q0dSkYj561DX7s1CpBuOBtReveal

Why it works

suconnect runs setuid as bandit21 and connects to a port you name, reads one line, and compares it against the current password. Upon a successful match it sends back the next one. The backgrounded nc -l listener serves the current password on localhost, so the two ends complete the handshake.