Bandit Level 18 → Level 19

As we can see the connection is immediately closed.

We can trick it to run a command before the ssh connection closed, by typing the command after the ssh command:

ssh [e-mail] -p 2220 ls
	<Password>

Ls is not a valid ssh option, so ssh will run it after the connection started, so we can use for example /bin/bash

ssh [e-mail] -p 2220 /bin/bash
	<Password>

ls

cat readme

Here is the password. We can also use -t to tell ssh to specify a shell:

ssh [e-mail] -p 2220 -t "/bin/sh"
	<Password>