Login

SSH: ssh bandit2@bandit.labs.overthewire.org -p 2220

Password: CV1DtqXWVFXTvM2F0k09SHz0YwRINYA9

Task

The password for the next level is stored in a file called spaces in this filename located in the home directory.

A little bit of Theory

Like in the previous level, it is unconventional and goes against best practice to include spaces in a filename (as well as a directory name). Instead, you can use an underscore (_) or a dash (-).

The reason for this, you can see in the first part of the solution. In a command, spaces indicate a new addition to the command. For example (in the solution), we use the cat command, which can take multiple filenames to output text from. And these file names would be separated by space. As can be seen in the solution, instead of outputting the text from the file called ‘spaces in this filename’, it looks for four files called: ‘spaces’, ‘in’, ’this’, ‘filename’.

In case you do encounter a file or directory with space, you have to indicate that the words belong together to one name. This can be done with quotes (single or double), as seen in the solution for this chapter.

Solution

Similar to the previous level, simply trying to use the filename does not work:

1
2
3
4
5

bandit2@bandit:~$ cat spaces in this filename
cat: spaces: No such file or directory
cat: in: No such file or directory
cat: this: No such file or directory
cat: filename: No such file or directory

This is because it assumes that we look at four files (or directories), which, however, do not exist.

Instead, we need to surround names with spaces with quotes (single or double) to indicate that all of it belongs to the name for one file:

1
2

bandit2@bandit:~$ cat "spaces in this filename"
UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK

And we can read the file and get the next password.

https://overthewire.org/wargames/bandit/bandit3.html