Level32

Level Goal

After all this git stuff its time for another escape. Good luck!

Solution

The goal states that this will be an escape, so to find out the shell that is set for bandit32 we can look in the /etc/passwd file. Looking at the file we see in passwd, we can see that it’s a setuid executable owned by bandit33.

Logging in as bandit22 drops us in this shell. It seems like everything we type gets uppercased and then passed to sh. Looking at the sh man page we see that there are special parameters built in to sh. These special parameters don’t involve letters, so uppershell can’t capatalize them. If we use the “$$” parameter we can see the PID of the shell, so we know these parameters are being passed to sh. The man page tells us that the “$0” parameter expands to the name of the shell or shell script. Using that causes the name of the shell to be executed by sh, and we get a new shell as bandit33. We can now get the password for bandit33.