Skip to content

2.1.Bandit level 0 to 10 (Overthewire)

Bandit Level 1 → Level 10

— First, you have to use ssh to login to the server with the following information

  • Username: bandit0

  • Password: bandit0

  • Host: bandit.labs.overthewire.org

  • Port: 2220

An important note: You must always log out of each level until you change the number and enter the password for the new level

Bandit Level

The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.

In the beginning, you have to :

the password is : bandit0

Bandit Level 0 → Level 1

The password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.

We have to find the password to reach the next level :

To connect to the next level password :

Bandit Level 1 → Level 2

The password for the next level is stored in a file called — located in the home directory .

To reach the next level:

password : NH2SXQwcBdpmTEzi3bvBHMM9H66vVXjL

— We now have to find the password for the next level :

Here is the password .

Bandit Level 2 → Level 3

The password for the next level is stored in a file called spaces in this filename located in the home directory .

To sign up : ssh bandit2@bandit.labs.overthewire.org -p 2220

Password : rRGizSaX8Mk1RTb1CNQoXTcYZWU6lgzi

Here you have to use the TAB button, to make things easier :

Here is the password .

Bandit Level 3 → Level 4

The password for the next level is stored in a hidden file in the inhere directory.

To sign up : ssh bandit3@bandit.labs.overthewire.org -p 2220

Password : aBZ0W5EmUfAf7kHTQeOwd8bauFJ2lAiG

The password is inside the hidden file .

Bandit Level 4 → Level 5

The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the “reset” command.

To sign up : ssh bandit4@bandit.labs.overthewire.org -p 2220

Password : 2EW7BBsr6aMMoJ2HjW067dm8EgX26xNe

Let’s go to the next stage .

Here we used ls -a to find out hidden files .

The file command in Linux is used to determine the type of a file ,

directoryname /* option : This is used to display all files filetypes in particular directory.

They also used the dot **(.)**to say “width from here”, from where you stand .

Bandit Level 5 → Level 6

The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties:

  • human-readable

  • 1033 bytes in size

  • not executable

To sign up : ssh bandit5@bandit.labs.overthewire.org -p 2220

Password : lrIWWI6bB37kxfiCQZqUdOIYfr6eEeqR

Here we must use the find command :

Here is the password .

Use -type f to specify the file type .

Use -size 1033c to specify the bytes we want in the file .

We used \! -executable, to specify that the file is not executable .

Bandit Level 6 → Level 7

The password for the next level is stored somewhere on the server and has all of the following properties:

  • owned by user bandit7

  • owned by group bandit6

  • 33 bytes in size

To sign up : ssh bandit6@bandit.labs.overthewire.org -p 2220

Password : P4L4vucdmLnm8I7Vl7jG1ApGSfjYKqJU

It wasn’t the best way to get what I wanted out of it .

I extracted the file with all the same specifications, and used the grep command to remove bandit7 from the output .

So we will use 2>/dev/null , to prevent too much output and output only what we want .

This is better .

Bandit Level 7 → Level 8

The password for the next level is stored in the file data.txt next to the word millionth .

To sign up : ssh bandit7@bandit.labs.overthewire.org -p 2220

Password : z7WtoNQU2XfjmMtWA8u5rN4vzqu4v99S

The first way .

Here we used grep command, to output the millionth line, to output the password .

The second method is to use vi or nano and then extract the line by searching inside the file :

The second way .

Bandit Level 8 → Level 9

The password for the next level is stored in the file data.txt and is the only line of text that occurs only once .

To sign up : ssh bandit8@bandit.labs.overthewire.org -p 2220

Password : TESKZC0XvTetK0S9xNwm25STk5iWrBvP

Here is the new password .

The sort command in Unix-based systems is used to sort the contents of a text file called data.txt in alphabetical order. The sort command can also be used to sort in reverse alphabetical order, numerically, and by other criteria.

The uniq -u command in Unix-based systems is used to print only unique lines from a text file. The -u option tells the uniq command to print only lines that have not been seen before.

Bandit Level 9 → Level 10

The password for the next level is stored in the file data.txt in one of the few human-readable strings, preceded by several ‘=’ characters.

To sign up : ssh bandit9@bandit.labs.overthewire.org -p 2220

Password : EN632PlfYiZbn3PhVK3XOGSlNInNE00t .

When he looked into the matter further, he learned that the file was not readable at all, so I tried to search using the grep command, but it did not work, so :

Uses of the strings command ; The strings command is a Unix/Linux command-line utility used to extract and display printable strings from non-text files.

Here is the new password .

Bandit Level 10 → Level 11

The password for the next level is stored in the file data.txt, which contains base64 encoded data .

To sign up : ssh bandit10@bandit.labs.overthewire.org -p 2220

Password : G7w8LIi6J3kTb8A7j9LgrywtEUlyyp6s

Here we should have used — help .

So we have to decode the file using -d :

The end for the day

This is my first report here. I always recorded reports on Word files, but they always got lost, so I decided to write here until the end.

I hope it will be useful to everyone and be a good reference for readers .

💬 "Control the code, and you control the world." 🔐 From wiping metadata to gaining root access — every step is documented and my goal is to deeply understand the system, not just hack!

Abdelwahab Shandy

Linkedin

GitHub

See You Soon

AS Cyber “)).