I’m starting to notice a pattern with these levels. There’s a file that contains the password, and I need to find it. If you haven’t had a chance to read my write up of the previous level, head over to OverTheWire Bandit Write Up – Level 1 give it a read, then come back and read my bandit level 2 write up here.
This level has a similar aspect to the last two. A file in the home directory of the user, most importantly it contains the password. The name of the file is once again unknown, but with just a few commands this shouldn’t be a issue.
Let’s Start Hacking Then
So we need to SSH once again into the server, this time using the bandit level 2 user, and the password I found in the last level. I can get in with the following command
ssh email@example.com -p 2220
Now I’m in, I can run the old faithful command
ls. This gives me a file named
spaces in this filename. Okay so I have the filename but if I type the following command.
cat ./spaces in the filename
I’m presented with a couple of error messages. It seems that the terminal is trying to read each word as a separate file, or directory.
cat: spaces: No such file or directory cat: in: No such file or directory cat: this: No such file or directory cat: filename: No such file or directory
So I need to get it to read it as a single file. I do some Googling and come across a blog post on the Hectic Geek blog about Dealing with Spaces in Filenames in Command-line. Now I know I can add a
\ before the space and it should read the file correctly. So I run the following command…
cat ./spaces\ in\ this\ filename
…and Wham! Bam! Thank you ma’am! I have the password now for level 3.
Level 2 Complete!
I have hidden the password here, if you are playing along don’t peek! Please! It’s more fun getting it yourself.
Level 3 Passsword