OverWire Bandit level 29

sanday.c
2 min readAug 30, 2021

Use ssh to login the server with the following information.

  • Username: bandit29
  • Password: bbc96594b4e001778eee9975372716b2
  • Host: bandit.labs.overthewire.org
  • Port: 2220
$ ssh bandit29@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargamesbandit29@bandit.labs.overthewire.org's password:
bbc96594b4e001778eee9975372716b2

Let’s find the password for the next level.

bandit29@bandit:~$ mkdir -p /tmp/secttp
bandit29@bandit:~$ cd /tmp/secttp
bandit29@bandit:/tmp/secttp$ git clone ssh://bandit29-git@localhost/home/bandit29-git/repo
Cloning into 'repo'...
Could not create directory '/home/bandit29/.ssh'.
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/bandit29/.ssh/known_hosts).
This is a OverTheWire game server. More information on http://www.overthewire.org/wargamesbandit29-git@localhost's password:
bbc96594b4e001778eee9975372716b2remote: Counting objects: 16, done.
remote: Compressing objects: 100% (11/11), done.
remote: Total 16 (delta 2), reused 0 (delta 0)
Receiving objects: 100% (16/16), done.
Resolving deltas: 100% (2/2), done.
bandit29@bandit:/tmp/secttp$ cd repo/
bandit29@bandit:/tmp/secttp/repo$

By default, with no arguments, git log lists the commits made in the repository in reverse chronological order. We usegit log command with -p option to show the diff introduced in each commit.

bandit29@bandit:/tmp/secttp/repo$ git log -p
commit 84abedc104bbc0c65cb9eb74eb1d3057753e70f8
Author: Ben Dover <noone@overthewire.org>
Date: Tue Oct 16 14:00:41 2018 +0200fix usernamediff --git a/README.md b/README.md
index 2da2f39..1af21d3 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,6 @@ Some notes for bandit30 of bandit.## credentials-- username: bandit29
+- username: bandit30
- password: <no passwords in production!>commit 9b19e7d8c1aadf4edcc5b15ba8107329ad6c5650
Author: Ben Dover <noone@overthewire.org>
Date: Tue Oct 16 14:00:41 2018 +0200initial commit of README.mddiff --git a/README.md b/README.md
new file mode 100644
index 0000000..2da2f39
--- /dev/null
+++ b/README.md
@@ -0,0 +1,8 @@
+# Bandit Notes
+Some notes for bandit30 of bandit.
+
+## credentials
+
+- username: bandit29
+- password: <no passwords in production!>
+
bandit29@bandit:/tmp/secttp/repo$ git branch
* master
bandit29@bandit:/tmp/secttp/repo$ git branch -r
origin/HEAD -> origin/master
origin/dev
origin/master
origin/sploits-dev
bandit29@bandit:/tmp/secttp/repo$ git checkout dev
Branch dev set up to track remote branch dev from origin.
Switched to a new branch 'dev'
bandit29@bandit:/tmp/secttp/repo$ git branch
* dev
master
bandit29@bandit:/tmp/secttp/repo$ git log -p -1
commit 33ce2e95d9c5d6fb0a40e5ee9a2926903646b4e3
Author: Morla Porla <morla@overthewire.org>
Date: Tue Oct 16 14:00:41 2018 +0200add data needed for developmentdiff --git a/README.md b/README.md
index 1af21d3..39b87a8 100644
--- a/README.md
+++ b/README.md
@@ -4,5 +4,5 @@ Some notes for bandit30 of bandit.
## credentials- username: bandit30
-- password: <no passwords in production!>
+- password: 5b90576bedb2cc04c86a9e924ce42faf

--

--