Introduction
As we continue our ascent in the Bandit Challenge, Level 20 ↗️ brings a new challenge in the form of a setuid binary. Our task is to execute this binary to access the password required for the next level.
Challenge Overview
Level 20 challenges us to use a setuid binary located in the home directory to gain access to the password for the next level. Setuid binaries are executables that are set to run with the privileges of the file owner, allowing us to perform actions we wouldn’t typically have permission for.
Our goal is to execute the binary without arguments to uncover its functionality and retrieve the password.
Approach and Strategy
Follow these steps to successfully solve Level 20
Enter the password you obtained from the previous level.
Once logged in, locate the setuid binary using the ls command
ls -lThe binary will have the setuid permission displayed as an s in the file permissions field.
total 16-rwsr-x--- 1 bandit20 bandit19 14876 Apr 23 18:04 bandit20-doExecute the setuid binary without arguments to understand its functionality as suggested by the challenge.
./bandit20-doThis command will execute the setuid binary and display information about its usage.
Run a command as another user. Example: ./bandit20-do idSince we want to get the password for bandit20, we will execute the setuid binary to access the password by getting the file contents of the /etc/bandit_pass/bandit20 file.
./bandit20-do cat /etc/bandit_pass/bandit20This command uses the setuid binary to read the password from the specified file.
The output of the command will display the password for the next level. Take note of it for the next level.
Notes
- Setuid binaries allow execution with the privileges of the file owner. One good example is the
passwdcommand, which allows users to change their passwords. This command is owned by the root user and has the setuid permission set, allowing users to change their passwords without having root privileges.
Conclusion
Congratulations on successfully completing Level 20 of the Bandit Challenge! By executing the setuid binary and utilizing its capabilities, we accessed the password for the next level.
Stay tuned for the next blog post, where we’ll take on Level 21 and continue our quest to become skilled cybersecurity practitioners.