Skip to content
Idan.Lab

Bandit 32 → 33

OverTheWire Linux Progressive

Goal: escape a shell that converts everything you type to uppercase, then read bandit33’s password.

Approach

Section titled “Approach”
bandit32@bandit
WELCOME TO THE UPPERCASE SHELL
>> $0
$ cat /etc/bandit_pass/bandit33
The password you are looking for is: <password>
PasswordtQdtbs5D5i2vJwkO8mEyYEyTL8izoeJ0

Why it works

Section titled “Why it works”

The input wrapper converts all typed commands to uppercase, so ls becomes LS and nothing on PATH matches. However, $0 expands to the name the current shell was invoked as, and the shell resolves that variable before the uppercasing matters, so running it launches a fresh normal shell. From that prompt commands run unfiltered.