OverTheWire - Bandit - Level 28 → Level 29

Warning: This post contains a solution!

Continue only if:
1.) you want to see a possible alternative solution or
2.) you are stuck and need a hint!


Connect to the server using the following credentials:

Server: bandit.labs.overthewire.org
Port: 2220
Username: bandit28
Password: 0ef186ac70e04ea33b4c1853d2526fa2

Level Goal is:

There is a git repository at ssh://bandit28-git@localhost/home/bandit28-git/repo. The password for the user bandit28-git is the same as for the user bandit28.
Clone the repository and find the password for the next level.

Clone the repository and check folders/files.

λ git clone ssh://bandit28-git@bandit.labs.overthewire.org:2220/home/bandit28-git/repo
Cloning into 'repo'...
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames

bandit28-git@bandit.labs.overthewire.org password:
remote: Counting objects: 9, done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 9 (delta 2), reused 0 (delta 0)
Receiving objects: 100% (9/9), done.
Resolving deltas: 100% (2/2), done.

Y:\Sites\www.overthewire.org\bandit\level28_29
λ ls
repo/

Y:\Sites\www.overthewire.org\bandit\level28_29
λ cd repo\

Y:\Sites\www.overthewire.org\bandit\level28_29\repo (master -> origin)
λ ls
README.md

Y:\Sites\www.overthewire.org\bandit\level28_29\repo (master -> origin)
λ cat README.md
# Bandit Notes
Some notes for level29 of bandit.

## credentials

- username: bandit29
- password: xxxxxxxxxx

No password in this file. Since we are in a git repository, we can use the git log command to see the recent commits.

Y:\Sites\www.overthewire.org\bandit\level28_29\repo (master -> origin)
λ git log
commit 073c27c130e6ee407e12faad1dd3848a110c4f95 (HEAD -> master, origin/master, origin/HEAD)
Author: Morla Porla <morla@overthewire.org>
Date:   Tue Oct 16 14:00:39 2018 +0200

    fix info leak

commit 186a1038cc54d1358d42d468cdc8e3cc28a93fcb
Author: Morla Porla <morla@overthewire.org>
Date:   Tue Oct 16 14:00:39 2018 +0200

    add missing data

commit b67405defc6ef44210c53345fc953e6a21338cc7
Author: Ben Dover <noone@overthewire.org>
Date:   Tue Oct 16 14:00:39 2018 +0200

    initial commit of README.md

The comment 'add missing data' sounds interesting, let's checkout this commit and take a look at the content of the README file again.

Y:\Sites\www.overthewire.org\bandit\level28_29\repo (master -> origin)
λ git checkout 186a1038cc54d1358d42d468cdc8e3cc28a93fcb
Note: switching to '186a1038cc54d1358d42d468cdc8e3cc28a93fcb'.

[...]

HEAD is now at 186a103 add missing data

Y:\Sites\www.overthewire.org\bandit\level28_29\repo (HEAD detached at 186a103 -> origin)
λ cat README.md
# Bandit Notes
Some notes for level29 of bandit.

## credentials

- username: bandit29
- password: bbc96594b4e001778eee9975372716b2

Password found.

Show Comments