# OverTheWire: Bandit \[1-23\] **URL:** \ **Category:** Event\ **Created:** [July 8, 2025, 8:44pm UTC](https://forum.dmz.rs/t/overthewire-bandit-1-23/1196 "2025-07-08T20:44:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![He4eT](https://forum.dmz.rs/user_avatar/forum.dmz.rs/he4et/32/1860_2.png) [@He4eT](https://forum.dmz.rs/u/He4eT)\ **Post date:** [July 8, 2025, 8:44pm UTC](https://forum.dmz.rs/t/overthewire-bandit-1-23/1196/1 "2025-07-08T20:44:14Z")
> **[OverTheWire: Bandit](https://overthewire.org/wargames/bandit/)** ```sh lynx https://overthewire.org/wargames/bandit/ ``` ## 0 ```auto ssh bandit0@bandit.labs.overthewire.org -p 2220 ``` ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If ## 1 ```auto cat ./- ``` 263JGJPfgU6LtdEvgfWU1XP5yac29mFx ## 2 ```auto cat "spaces in this filename" ``` MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx ## 3 ```auto cat ./inhere/...Hiding-From-You ``` 2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ ## 4 ```auto file ./inhere/-* cat ./inhere/-file07 ``` 4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw ## 5 ```auto find -type f -size 1033c cat ./inhere/maybehere07/.file2 ``` HWasnPhtq9AVKe0dmk45nxy20cvUa6EG ## 6 ```auto find / -user bandit7 -group bandit6 -size 33c 2>/dev/null cat $(find / -user bandit7 -group bandit6 -size 33c 2>/dev/null) ``` morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj ## 7 ```auto grep 'millionth' data.txt ``` dfwvzFQi4mU0wfNbFOe9RoWskMLg7eEc ## 8 ```auto cat data.txt | sort | uniq -u ``` 4CKMh1JI91bUIZZPXDqGanal4xvAg0JM ## 9 ```auto strings data.txt | grep '==' ``` FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey ## 10 ```auto cat data.txt | base64 -d ``` dtR173fZKb0RRsDFSGsg2RWnpNVj3qRr ## 11 ```auto cat data.txt | tr 'a-zA-Z' 'n-za-mN-ZA-M' The password is 7x16WNeHIi5YkIhWsfFIqoognUTyj9Q4 ``` ## 12 ```auto 31 xxd -r dump.hex 0 33 file 0 35 gzip -d 0 37 mv 0 1 38 ls 39 zcat -d 1 40 zcat -d 1 > 2 41 ls 42 file 2 44 bzcat -d 2 > 3 45 file 3 46 zcat -d 3 > 4 47 file 4 54 tar xvf 4 56 file data5.bin 57 tar xvf data5.bin 58 file data6.bin 61 bzcat -d data6.bin > 7 63 file 7 64 tar xvf 7 65 file data8.bin 67 zcat -d data8.bin > 9 68 file 9 69 cat 9 ``` FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn # 13 ```auto ssh -i sshkey.private bandit14@localhost -p 2220 cat /etc/bandit_pass/bandit14 ``` MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS # 14 ```auto nc localhost 30000 MU4VWeTyJk8ROof1qqmcBPaLh7lDCPvS Correct! ``` 8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo ---
**Author:** ![coja](https://forum.dmz.rs/user_avatar/forum.dmz.rs/coja/32/1856_2.png) [@coja](https://forum.dmz.rs/u/coja)\ **Post date:** [May 29, 2026, 11:21pm UTC](https://forum.dmz.rs/t/overthewire-bandit-1-23/1196/2 "2026-05-29T23:21:21Z")
# Level 15 ```auto $ openssl s_client localhost:30001 8xCjnmgoKbGLhHFAZlGE5Tmu4M2tKJQo Correct! ``` kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx # Level 16 ```auto $ nmap -sC -p 31000-32000 localhost $ openssl s_client -nocommands localhost:31790 kSkvUpMQ7lBYyCM4GBPvCvT1BfWRy0Dx Correct! ``` -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama +TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT 8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM 77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3 vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY= -----END RSA PRIVATE KEY----- # Level 17 To connect to the level 17, write the RSA key to a file with permissions 600. Make sure the following command return the same output: ```auto $ ls -l password.txt -rw------- 1 user user 1675 May 18 20:07 password.txt ``` Use the following command to connect to the server: ```auto ssh -p 2220 -i password.txt bandit17@bandit.labs.overthewire.org ``` # Level 18 ```auto $ diff passwords.new passwords.old 42c42 < x2gLTTjFwMOhQ8oWNbMN362QKxfRqGlO --- > KxOU4IzbXM8j8HeAWPAXTd1eC77mp1qV ``` x2gLTTjFwMOhQ8oWNbMN362QKxfRqGlO # Level 19 ```auto $ ssh -p 2220 bandit18@bandit.labs.overthewire.org "cat readme" ``` cGWpMaKXVwDUNgPAVJbWYuGHVn9zl3j8 # Level 20 ```auto $ ./bandit20-do cat /etc/bandit_pass/bandit20 ``` 0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO # Level 21 The first command runs a TCP server that sends the current password as soon as a client connects. The second command is the client that receives the current password, and replies with the next. ```auto $ nc -l 3000 < /etc/bandit_pass/$USER & $ ./suconnect 3000 Read: 0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO Password matches, sending next password EeoULMCra2q0dSkYj561DX7s1CpBuOBt ``` EeoULMCra2q0dSkYj561DX7s1CpBuOBt # Level 22 ```auto $ cat /etc/cron.d/cronjob_bandit22 @reboot bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null * * * * * bandit22 /usr/bin/cronjob_bandit22.sh &> /dev/null $ cat /usr/bin/cronjob_bandit22.sh #!/bin/bash chmod 644 /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv cat /etc/bandit_pass/bandit22 > /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv $ cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv ``` tRae0UfB9v0UzbCdn9cY0gQnds9GF58Q # Level 23 ```auto $ cat /etc/cron.d/cronjob_bandit23 @reboot bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null * * * * * bandit23 /usr/bin/cronjob_bandit23.sh &> /dev/null $ cat /usr/bin/cronjob_bandit23.sh #!/bin/bash myname=$(whoami) mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1) echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget" cat /etc/bandit_pass/$myname > /tmp/$mytarget $ cat /tmp/$(echo I am user bandit23 | md5sum | cut -d ' ' -f 1) ``` 0Zf11ioIjMVN551jX3CmStKLYqjk54Ga ---
**Author:** ![disu1950](https://forum.dmz.rs/user_avatar/forum.dmz.rs/disu1950/32/1867_2.png) [@disu1950](https://forum.dmz.rs/u/disu1950)\ **Post date:** [June 1, 2026, 3:57am UTC](https://forum.dmz.rs/t/overthewire-bandit-1-23/1196/3 "2026-06-01T03:57:22Z")
@coja nezaustavljit… doktor sve zna 🙂 😉👍 * * * ## Level Goal 24 → 25 A daemon is listening on port 30002 and will give you the password for bandit25 if given the password for bandit24 and a secret numeric 4-digit pincode. There is no way to retrieve the pincode except by going through all of the 10000 combinations, called brute-forcing. You do not need to create new connections each time * * * Ciljni nivo Daemon **(DEMON)** osluškuje port **30002** i dat će vam lozinku za `bandit25` ako dobijete lozinku za `bandit24` i tajni numerički 4-cifreni PIN kod. Ne postoji način da se povrati PIN kod osim prolaskom kroz svih 10000 kombinacija, što se naziva brute-forcing. Ne morate svaki put kreirati nove veze. * * * AJMO @coja DI SMO ZAPELI? KAKO DALJE? HH hack bandit xDD