Bandit 22 → 23

OverTheWire Linux Progressive

Goal: read the password the bandit23 cron job writes to a file named from its own username.

Approach

bandit22@bandit

bandit22@bandit:~$ cat /usr/bin/cronjob_bandit23.sh
#!/bin/bash
myname=$(whoami)
mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget
bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1
8ca319486bfbbc3663ea0fbe81326349
bandit22@bandit:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349
The password you are looking for is: <password>

Password0Zf11ioIjMVN551jX3CmStKLYqjk54GaReveal

Why it works

The job runs as bandit23 and stores its password under /tmp in a file named by the MD5 hash of a fixed string. MD5 is deterministic, so the same input always yields the same name. Recomputing it locally tells you exactly where to look. A predictable filename is not a secret one.