Level: 0→1
Level: 1→2
Level: 2→3
Level: 3→4
Level: 4→5
Level: 5→6
Level: 6→7
Level: 7→8
Level: 8→9
Level: 9→10
Level: 10→11
Level: 11→12
Level: 12→13
Level: 13→14
Level: 14→15
Level: 15→16
Level: 16→17
Level: 17→18
Level: 18→19
Level: 19→20
Level: 20→21
Level: 21→22
Level: 22→23
Level: 23→24
Level: 24→25
Level: 25→26
Level: 26→27
Level: 27→28
Level: 28→29
Level: 29→30
Level: 30→31
Level: 31→32
Level: 32→33
Level: 33→34

~ Level 6→7 ~

Level Description

The password for the next level is stored somewhere on the server and has all of the following properties: owned by user bandit7, owned by group bandit6, and 33 bytes in size.

Commands that may be useful in solving this level include: ls, cd, cat, file, du, find, and grep.

Research Before Solving

Only one command of the 7 provided are new to us. This command is known as grep. Use the help function or your preferred search engine to learn about this new command.

Grep will allow a user to search for a particular word, phrase, or set of characters within directories and files.

Solution Walkthrough

Log in to the OverTheWire server as user bandit6 while using the corresponding password found in the previous level. You can use the ls command to start as we have done in the past. Notice how you recieve no results. If you add the -a switch to it, a few results will be printed to the screen.

Using cat with each filename will open its contents. We can look through the results to see if anything useful is presented. In this instance, no vital information is provided.

Going back to the level description, the creators specifically state the password is somewhere on the server. Using this information we can ascertain that we may not be in the directory where the password is stored. We can move up in the hierarchy of directories with one of two methods. You may of noticed that using the ls command always returns results that include .. as a result. This notation is used to represent the directory above the current working directory. If we use cd .. we are able to ascend one directory. After performing this command twice, we are in the root directory. This is the highest point of the hierarchical directory system. The second method is to use cd / where the slash stands for the root directory itself. Both methods are shown in succession below with a command in between that returns us to the directory we started in.

Now that we are in the root directory, denoted by the / before the $, we can use the functionality of find and its available switches. We know we must use the -size option along with 33c. By the clues given we know that the user and group are important. The options that allow us to search for files that meet this criteria are -user and -group. We tack on the respective group and user information provided by OverTheWire and our command becomes this: find -user bandit7 -group bandit6 -size 33c

Results of find command that meets required criteria

One of the results listed is not like the others! Looking at the forth result from the bottom, bandit7.password can be seen. It is the only result without a permission denied tag stuck to it as well. We can clean the up the results a bit, the next sections detail how to do so.

/dev/null in Linux

/dev/null is a directory inside of the Linux system that acts as a black hole. Any data that is directed here is discarded. Using this newfound knowledge, we can try to devise a way to send any result where permissions were denied to /dev/null.

Standard Input, Standard Output, and Standard Error

Standard input is given a descriptor value of 0 and includes any input that a user provides to the system through a keyboard. Examples of Standard Input include any and all commands that we may type into the console such as cd, cat and find. Standard output has the value of 1 and includes the results from any standard input. The value of 1 is assumed to be the user's display unless another value is assigned. Descriptor value 2 is attributed to standard error. This value also defaults to printing to a user's display. If we redirect the value of 2 to /dev/null, the results that would have been printed to the display by default, should instead be sent into the black hole to be discarded.

We will now append 2>/dev/null to the end of our find command. To reiterate the logic used here; 2 will take the results that ended in error (permission denied) while the > tells the interpreter we would like to pass the selected data into the /dev/null directory.

Let's try the full command: find -size 33c -user bandit7 -group bandit6 2>/dev/null

Result of find command without error output

As you can see, the output is much more accessible. All that is left is to use cat to read the contents of the file.

Log out of the current session and move on to the next level! Make sure to record the password for safekeeping: HKBPTKQnIay4Fw76bEy8PVxKEDQRKTzs

Previous Level

Next Level