Skip to content

Latest commit

 

History

History
21 lines (12 loc) · 1.18 KB

Bandit_Level_32.md

File metadata and controls

21 lines (12 loc) · 1.18 KB

Bandit Level 32

In this level we do not get much of a hint; we are merely told that it is another escape challenge.

When we connect to the level, we get the message WELCOME TO THE UPPERCASE SHELL

As we start to run commands, we can see that the shell is not interpreting them properly. It is converting them to uppercase before parsing them.

58e67432.png

Unlike Windows, Linux systems are case-sensitive. Due to the fact that most linux commands are lowercase, we can't run any commands. One of the few things that are uppercase are environment variables. These are used to communicate system information (such as the shell used or the location of binaries) to programs. Some common ones include:

  • $SHELL
  • $PATH
  • $USER

These expand to their contents, so if they point to a binary we are able to use that binary.

9a4e9098.png

There is one environment variable that is present on some (but not all) Linux systems that points to the system backup shell. Running $0 as a command gives us a /bin/sh session. Using this shell we can open the password file /etc/bandit_pass/bandit33, revealing the password: odHo63fHiFqcWWJG9rLiLDtPm45KzUKy