Bandit 26 → 27

OverTheWire Linux Progressive

Goal: read bandit27’s password using the setuid helper in the home directory.

Approach

bandit26@bandit

bandit26@bandit:~$ ls
bandit27-do  text.txt
bandit26@bandit:~$ ./bandit27-do cat /etc/bandit_pass/bandit27
The password you are looking for is: <password>

PasswordupsNCc7vzaRDx6oZC6GiR6ERwe1MowGBReveal

Why it works

Same setuid pattern as level 19: bandit27-do runs with its owner’s (bandit27) privileges and forwards whatever command you hand it, so a single cat reads bandit27’s password file. (Reaching a shell as bandit26 in the first place is the pager escape from the previous level.)