# Bandit Level 20 → Level 21

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FWPEbrtvyJpfSJWdjM9cH%2Fimage.png?alt=media&#x26;token=e0acdfac-7c6b-48e8-8527-e015474bc8bb" alt=""><figcaption></figcaption></figure>

Lets list the files in the home directory, and try that binary on port 22:

```bash
ls
```

```bash
./suconnect 22
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FPmxTNF6RFW2aiDmdLWgj%2Fimage.png?alt=media&#x26;token=de400b22-f362-4235-8451-316d1da38ab3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FQOTq4TpBZzgjW0fH5tvk%2Fimage.png?alt=media&#x26;token=26cfd86a-b578-47f4-a773-fa7ab083aaeb" alt=""><figcaption></figcaption></figure>

As we can see, when we tried to connect on port 22, it received the SSH banner and compared it to the current password, so there should be an open port that will send the password:

```bash
echo "0qXahG8ZjOVMN9Ghs7iOWsCfZyXOUbYO" | nc -vlp 1337
```

This command will wait for any connection and pass that strings that is the current password to it.

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FmHgmPItttJgxZzkB5blQ%2Fimage.png?alt=media&#x26;token=4a8eb097-8745-42e7-94ff-4f06a163364f" alt=""><figcaption></figcaption></figure>

Lets run that binary again on that port:

```bash
./suconnect 1337
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FLlGCrhHGt9btLf2fI8Zr%2Fimage.png?alt=media&#x26;token=c8684f63-41cd-4b4d-8ba8-1556c51ce5e0" alt=""><figcaption></figcaption></figure>

It get the correct password, and if we check the nc again:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FQfm9cUBXsmpTiFqmqiml%2Fimage.png?alt=media&#x26;token=9b9b3522-f16b-462b-9dca-73f37f0ad721" alt=""><figcaption></figcaption></figure>

Here is the password for the next user.
