Bandit Level 20 → Level 21

Lets list the files in the home directory, and try that binary on port 22:

ls

./suconnect 22

As we can see, when we tried to connect on port 22, it received the SSH banner and compared it to the current password, so there should be an open port that will send the password:

echo "0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO" | nc -vlp 1337

This command will wait for any connection and pass that strings that is the current password to it.

Lets run that binary again on that port:

./suconnect 1337

It get the correct password, and if we check the nc again:

Here is the password for the next user.