Over The Wire – Bandit 20

Level Goal

There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21).

NOTE: Try connecting to your own network daemon to see if it works as you think

In this challenge, we have a file that connects to a specific port and waits for input.

All we have to do, is find a way to open a port, and send a string once a connection has been established.

Using netcat, we can setup a listener on a port we choose, and then connect to that port with the binary provided.

I opened up two terminals for this rather than messing with sending scripts to the background.

In the first terminal, I started a netcat listener on port 1337 (because why not)

Then, I ran the suconnect binary and specified port 1337 as the port to connect to

After launching the binary, I hopped back over to my terminal with netcat and sent the previous flag, getting the new flag as a response!

Looking at the other terminal, we can see the other side of this connection (not required for the flag but just some extra information).