Login

SSH: ssh bandit3@bandit.labs.overthewire.org -p 2220

Password: UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK

Task

The password for the next level is stored in a hidden file in the inhere directory.

A little bit of Theory

To traverse the directories, the “change directory” command exists: cd <path>.

The path for the command can be an absolute path (path from root directory /) or a relative path (path from the current working directory).

Interesting uses of the command are:

• cd .. goes to the parent directory
• cd / goes to the root directory
• cd ~ goes to the home directory (of the current user)

A hidden file in Linux starts with a .. The ls command shows only non-hidden files. However, with the -a flag it shows all files, specifically also the hidden files.

The first two hidden entries in the directories stand for the current (.) and the parent (..) directory.

Solution

With Traversal

First, we go to the correct folder and then print all its files to find the filename.

1
2
3

bandit3@bandit:~$ cd inhere
bandit3@bandit:~/inhere$ ls -a
.  ..  .hidden

Therefore our file with the password is called .hidden, and we can read its content.

1
2

bandit3@bandit:~/inhere$ cat .hidden
pIwrPrtPN36QITSp3EQaw936yaFoFgAB

And we got the password for the bandit4 user.

Without Traversal

Alternatively, this task could be done without directory traversal by adjusting the path of both the ls and the cat command:

1
2
3
4

bandit3@bandit:~$ ls -a \inhere
.  ..  .hidden
bandit3@bandit:~$ cat inhere/.hidden
pIwrPrtPN36QITSp3EQaw936yaFoFgAB

https://overthewire.org/wargames/bandit/bandit4.html