bandit2@bandit:~$ ls -la total 24 drwxr-xr-x 2 root root 4096 Aug 15 13:16 . drwxr-xr-x 150 root root 4096 Aug 15 13:18 .. -rw-r--r-- 1 root root 220 Mar 31 2024 .bash_logout -rw-r--r-- 1 root root 3851 Aug 15 13:09 .bashrc -rw-r--r-- 1 root root 807 Mar 31 2024 .profile -rw-r----- 1 bandit3 bandit2 33 Aug 15 13:16 --spaces in this filename-- bandit2@bandit:~$ cat -- --spaces in this filename-- cat: --spaces: No such file or directory cat: in: No such file or directory cat: this: No such file or directory cat: filename--: No such file or directory bandit2@bandit:~$ cat "--spaces in this filename--" cat: unrecognized option '--spaces in this filename--' Try 'cat --help' for more information. bandit2@bandit:~$ cat -- "--spaces in this filename--" MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx bandit2@bandit:~$
Linux 命令行中，以两个连字符 --开头的参数通常被解释为命令行选项 在命令行中，双连字符 -- 是一个特殊标记，它表示“此后的所有参数都不是选项，即使它们以 -开头。而空格的话，则可以用转义或者引号（单双）来处理。
MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx
Bandit Level 3 → Level 4
cat –
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
bandit3@bandit:~$ ls inhere bandit3@bandit:~$ ls -la total 24 drwxr-xr-x 3 root root 4096 Aug 15 13:16 . drwxr-xr-x 150 root root 4096 Aug 15 13:18 .. -rw-r--r-- 1 root root 220 Mar 31 2024 .bash_logout -rw-r--r-- 1 root root 3851 Aug 15 13:09 .bashrc drwxr-xr-x 2 root root 4096 Aug 15 13:16 inhere -rw-r--r-- 1 root root 807 Mar 31 2024 .profile bandit3@bandit:~$ cd inhere/ bandit3@bandit:~/inhere$ ls -la total 12 drwxr-xr-x 2 root root 4096 Aug 15 13:16 . drwxr-xr-x 3 root root 4096 Aug 15 13:16 .. -rw-r----- 1 bandit4 bandit3 33 Aug 15 13:16 ...Hiding-From-You bandit3@bandit:~/inhere$ cat -- '...Hiding-From-You' 2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ
2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ
Bandit Level 4 → Level 5
1 2 3 4 5 6 7 8 9
bandit4@bandit:~/inhere$ ls -file00 -file01 -file02 -file03 -file04 -file05 -file06 -file07 -file08 -file09 bandit4@bandit:~/inhere$ cat -- -file* | awk '{print}' END {print ""} awk: fatal: cannot open file `END' for reading: No such file or directory bandit4@bandit:~/inhere$ cat -- -file* \�G�I�d�� �`"��g��� '�����␦�Y��:bl�A��t�1�ν%gM������� ��u.Tq␦`h���Ee�+�<��"!^"�Jߑߟ����>jŠ␦��C�f�w��f>�<?��>��@F��kYq~Jjs�o��;���6���d�H@�9��I�}�v,��C�����Cy>f�|7�`i�} �ت�=ؑ�Hz����1�Uk�U���켼�U4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw x����/vSژ�5f`}�3Y�ׯ��=9]�
The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.Note:localhost is a hostname that refers to the machine you are working on。
bandit16@bandit:~$ nmap -p 31000-32000 localhost Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-13 14:59 UTC Nmap scan report for localhost (127.0.0.1) Host is up (0.00012s latency). Not shown: 996 closed tcp ports (conn-refused) PORT STATE SERVICE 31046/tcp open unknown 31518/tcp open unknown 31691/tcp open unknown 31790/tcp open unknown 31960/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new
NOTE: if you have solved this level and see ‘Byebye!’ when trying to log into bandit18, this is related to the next level, bandit19
myname=$(whoami) mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)
echo"Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"
cat /etc/bandit_pass/$myname > /tmp/$mytarget bandit22@bandit:~$ ls- la cat /etc/bandit_pass/bandit23 Command 'ls-' not found, did you mean: command'lsd' from snap lsd (0.16.0) command'lsc' from deb livescript (1.6.1+dfsg-3) command'lsm' from deb lsm (1.0.4-2) command'lsh' from deb lsh-client (2.1-14) command'lsd' from deb lsd (0.23.1-8) command'lsw' from deb suckless-tools (47-1) command'ls' from deb coreutils (9.4-2ubuntu2) See 'snap info <snapname>'for additional versions. bandit22@bandit:~$ ls -la cat /etc/bandit_pass/bandit23 ls: cannot access 'cat': No such file or directory -r-------- 1 bandit23 bandit23 33 Aug 15 13:15 /etc/bandit_pass/bandit23 bandit22@bandit:~$ echo I am user bandit23 | md5sum | cut -d ' ' -f 1 8ca319486bfbbc3663ea0fbe81326349 bandit22@bandit:~$ ^C bandit22@bandit:~$ cat /etc/bandit_pass/8ca319486bfbbc3663ea0fbe81326349 cat: /etc/bandit_pass/8ca319486bfbbc3663ea0fbe81326349: No such file or directory bandit22@bandit:~$ ls /etc/bandit_pass/ bandit0 bandit10 bandit12 bandit14 bandit16 bandit18 bandit2 bandit21 bandit23 bandit25 bandit27 bandit29 bandit30 bandit32 bandit4 bandit6 bandit8 bandit1 bandit11 bandit13 bandit15 bandit17 bandit19 bandit20 bandit22 bandit24 bandit26 bandit28 bandit3 bandit31 bandit33 bandit5 bandit7 bandit9 bandit22@bandit:~$ ls /tmp ls: cannot open directory '/tmp': Permission denied bandit22@bandit:~$ cat /tmp/8ca319486bfbbc3663ea0fbe81326349 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga bandit22@bandit:~$
命令解释
1 2
bandit22@bandit:~$ echo"I am user bandit23" | md5sum 8ca319486bfbbc3663ea0fbe81326349 -
cd /var/spool/$myname/foo echo"Executing and deleting all scripts in /var/spool/$myname/foo:" for i in * .*; do if [ "$i" != "." -a "$i" != ".." ]; then echo"Handling $i" owner="$(stat --format "%U" ./$i)" if [ "${owner}" = "bandit23" ]; then timeout -s 9 60 ./$i fi rm -f ./$i fi done
bandit23@bandit:~$ vim /var/spool/bandit24/foo/get_pass.sh bandit23@bandit:~$ cat /tmp/bandit24_pass gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8
Bandit Level 24 → Level 25
shell 循环代码书写以数据逐行发送
1 2 3 4 5 6 7 8 9
bandit24@bandit:~$ echo'gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8' | nc 127.0.0.1 30002 I am the pincode checker for user bandit25. Please enter the password for user bandit24 and the secret pincode on a single line, separated by a space. Wrong! Please enter the correct current password and pincode. Try again. gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 ^C bandit24@bandit:~$ echo'gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 1234' | nc 127.0.0.1 30002 I am the pincode checker for user bandit25. Please enter the password for user bandit24 and the secret pincode on a single line, separated by a space. Wrong! Please enter the correct current password and pincode. Try again. ^C
需要暴力破解 pincode
4-digit pincod，只需要尝试 0000 - 9999 即可
1 2 3 4
bandit24@bandit:~$ for pin in {0000..9999}; doecho"gb8KRRCsshuZXI0tUuR6ypOFjiZbf3G8 $pin"; done | nc localhost 30002 | grep -v "Wrong" I am the pincode checker for user bandit25. Please enter the password for user bandit24 and the secret pincode on a single line, separated by a space. Correct! The password of user bandit25 is iCi86ttT4KSNe1armKiwbQNmB3YJP3q4
经过验证，for 实现了生成密码并逐行传输的功能
1 2 3 4 5 6 7 8 9 10 11
Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Wrong! Please enter the correct current password and pincode. Try again. Correct! The password of user bandit25 is iCi86ttT4KSNe1armKiwbQNmB3YJP3q4
There is a git repository at ssh://bandit27-git@localhost/home/bandit27-git/repo via the port 2220. The password for the user bandit27-git is the same as for the user bandit27.
Clone the repository and find the password for the next level.
bandit33@bandit:~$ ls README.txt bandit33@bandit:~$ cat README.txt Congratulations on solving the last level of this game!
At this moment, there are no more levels to play in this game. However, we are constantly working on new levels and will most likely expand this game with more levels soon. Keep an eye out for an announcement on our usual communication channels! In the meantime, you could play some of our other wargames.
If you have an idea for an awesome new level, please let us know!
