OverTheWire - Bandit Level 3

Another straight-forward level without too much challenge besides a filename containing spaces. But it gives us the opprtunity to use TAB to auto-complete filenames, and CTRL-U for erasing the command line.

Level Instructions

The password for the next level is stored in a file called spaces in this filename located in the home directory.

Level Solution

First we have to login via SSH using the previous level’s user bandit2 (using their password CV1DtqXWVFXTvM2F0k09SHz0YwRINYA9 which we found in the previous level).

1. Connecting

1
2
3
4

ssh bandit2@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit2@bandit.labs.overthewire.org's password: 

Just copy and paste the password CV1DtqXWVFXTvM2F0k09SHz0YwRINYA9 when prompted, and hit ENTER. You won’t see a cursor. That’s normal.

2. Searching

We know the file is in the user’s home directory, which is usually where we land upon logging in, but we can also double check which directory we are in using the pwd command (i.e. “print working directory”):

1
2

bandit2@bandit:~$ pwd
/home/bandit2

Anyway, let’s continue and find the file we are after:

1
2
3
4
5
6
7
8

bandit2@bandit:~$ ls -la
total 24
drwxr-xr-x  2 root    root    4096 May  7 20:14 .
drwxr-xr-x 41 root    root    4096 May  7 20:14 ..
-rw-r--r--  1 root    root     220 May 15  2017 .bash_logout
-rw-r--r--  1 root    root    3526 May 15  2017 .bashrc
-rw-r--r--  1 root    root     675 May 15  2017 .profile
-rw-r-----  1 bandit3 bandit2   33 May  7 20:14 spaces in this filename

The command ls -la not only lists files in the current directory, but all of them, including hidden ones. I.e. files whose name starts with a period, such as .profile above. Just so we don’t miss anything hidden in plain sight. However, in this case we are looking for a file called spaces in this filename which is not a hidden file.

The file spaces in this filename above is what we are after, so let’s see what’s inside using cat:

1
2
3
4
5

bandit2@bandit:~$ cat spaces in this filename 
cat: spaces: No such file or directory
cat: in: No such file or directory
cat: this: No such file or directory
cat: filename: No such file or directory

Unfortunately the usual cat command (for outputting a file’s content to the terminal) doesn’t work, as the blankspace ( ) between each word makes it look like multiple files are being supplied as arguments. To work around this we need to either “escape” all blankspace characters with a backslash \ or enclose the entire filename in quotes ", e.g. "like this".

If we start typing cat spa we can just hit the TAB key to auto-complete, which in this turn adds all the necessary backslashes:

1

bandit2@bandit:~$ cat spaces\ in\ this\ filename

But I recommend just using surrounding quotes instead, and you can still auto-complete by typing cat "spa and then hit TAB when you do. So instead of submitting the previous command using the ENTER key, press CTRL-U to quickly erase the command line, making it ready for another command:

1
2

bandit2@bandit:~$ cat "spaces in this filename" 
UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK

That’s the “flag” we want to “capture” and the password we need for the next level, i.e. to login with user bandit3.

3. Exiting

1
2
3

bandit2@bandit:~$ exit
logout
Connection to bandit.labs.overthewire.org closed.

Level Flag

UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK