bandit-25

Logging in to bandit26 from bandit25 should be fairly easy… The shell for user bandit26 is not /bin/bash, but something else. Find out what it is, how it works and how to break out of it.

NOTE: if you’re a Windows user and typically use Powershell to ssh into bandit: Powershell is known to cause issues with the intended solution to this level. You should use command prompt instead.

creds to the description by kai lentit

explanation

greeted with a private key upon logging in

0
1

rsync -avh --progress bandit25@bandit:bandit26.sshkey bandit26
# yooooooooooooooink

it always throws you right back out when using the key to log in

0
1
2
3
4
5
6
7

Enjoy your stay!
  _                     _ _ _   ___   __
  | |                   | (_) | |__ \ / /
  | |__   __ _ _ __   __| |_| |_   ) / /_
  | '_ \ / _` | '_ \ / _` | | __| / / '_ \
  | |_) | (_| | | | | (_| | | |_ / /| (_) |
  |_.__/ \__,_|_| |_|\__,_|_|\__|____\___/
Connection to bandit.labs.overthewire.org closed.

appending a command to ssh doesn’t really work either, it just hangs

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

ssh -vi bandit26 bandit26@bandit vi
# ...
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: bandit26 RSA
  SHA256:WTr5/2jG+sBn33VnPPcUJ/C6+Ftef7zFIn5sSTUm0Xc explicit agent
debug1: Server accepts key: bandit26 RSA
  SHA256:WTr5/2jG+sBn33VnPPcUJ/C6+Ftef7zFIn5sSTUm0Xc explicit agent
Authenticated to bandit.labs.overthewire.org
  ([51.20.162.29]:2220) using "publickey".
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: client_input_global_request: rtype
  hostkeys-00@openssh.com want_reply 0
# ...
debug1: Sending environment.
debug1: channel 0: setting env LANG = "C.UTF-8"
debug1: Sending command: vi

a heredoc (multiline) reveals a little more insight, but not really the full picture

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

ssh -T -i bandit26 bandit26@bandit <<eof
  id
eof
#
#                          _                     _ _ _
#                         | |__   __ _ _ __   __| (_) |_
#                         | '_ \ / _` | '_ \ / _` | | __|
#                         | |_) | (_| | | | | (_| | | |_
#                         |_.__/ \__,_|_| |_|\__,_|_|\__|
#
#
#                       This is an OverTheWire game server.
#             More information on http://www.overthewire.org/wargames
#
# backend: gibson-0
# id
# ::::::::::::::
# /home/bandit26/text.txt
# ::::::::::::::
#   _                     _ _ _   ___   __
#  | |                   | (_) | |__ \ / /
#  | |__   __ _ _ __   __| |_| |_   ) / /_
#  | '_ \ / _` | '_ \ / _` | | __| / / '_ \
#  | |_) | (_| | | | | (_| | | |_ / /| (_) |
#  |_.__/ \__,_|_| |_|\__,_|_|\__|____\___/

so.. it is opening a connection & accepting the key.. what is the issue then?

let us reconsider the hint we received first, “what shell does user bandit26 use?” log back into bandit25 and check

0
1

grep "bandit26" /etc/passwd
# bandit26:x:11026:11026:bandit level 26:/home/bandit26:/usr/bin/showtext

that is not right..? /usr/bin/showtext is literally just the ascii art in the details dropdown above

a little retroperspective

welllll it is a bit more sophisticated than that & you will probably quit out furiously if you’ve been stuck on this for a while - i get it

ever encountered when less (or whatever pager you have) turns your buffered tty into raw mode? (more on cooked vs raw mode here, section 06) that is.. mostly it.. let me explain

a screen, that is too little to render the full output all at once, (contrary to cat, which prints everything to stdout no matter how much your terminal can visually display at once), will utilize a pager to let you navigate it at your own pace

if you believe you have NEVER used a pager (nor ever dared to open the man pages, wtf are you doing..?!) man <literally any shell builtin> & voila!

back to the topic

zoom into your current shell so much until less opens & interrupts kicking you out of the session, you should see a bunch of dashes, underscores; pipelines etc. pp. & at the very bottom --More--(83%)

now to do anything, basic motions of less are:

• j/k to navigate
• ctrl-d/ctrl-u to jump down/up half a page
• q to quit
• v to go into visual mode
• //? to forward/backward search (n/N for next/previous match)

with that concluded, hit v & it should send you into the visual editor, in this case vi, your favorite editor

inside vi, we can bring up vim’s built-in commands by hitting : which leads to the next step, changing the shell: :set shell=/bin/bash & now you’re able to execute ACTUAL commands via :!, f.e. :!echo hi

0
1

:!cat /etc/bandit_pass/bandit26
# jHdv2ELQhT22BkprMNDjybZDAkw1zeBJ

not that the password is any beneficial (it wont fix the wrong shell, surprise surprise :D), move onto bandit-26 since this seems to be done for the level - i would’ve included the rest for completion in here but oh well

 0
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

what could be a nice desscription for this level? i like playful descriptions like look at my other levels how i used descriptions

```md
date: '2026-09-16'
draft: false
description:
title: bandit-26
weight: 27

date: '2026-09-15'
description: daemon? demon? dodge srt?!
draft: false
title: bandit-24
weight: 25

date: '2026-09-15'
description: i take it back, screw (cron) j*bs
draft: false
title: bandit-23
weight: 24
``` \ (escaped because formatting would break)