DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

OverTheWire Bandit Level 2 Writeup — Read a Filename With Spaces

#security #ctf #beginners

The password file is named spaces in this filename. The shell splits unquoted arguments on whitespace, so the filename has to be quoted or escaped to be treated as one argument.

  • Platform: OverTheWire Bandit
  • Category: Linux Fundamentals
  • Level: 2 → 3
  • Difficulty: Beginner
  • Technique: Shell quoting and escaping

Challenge description

Level 2's home directory has one file, but its name contains spaces. In a shell, unquoted spaces separate arguments — so typing the filename as-is splits it into several nonsense arguments instead of one filename.

"Level Goal: The password for the next level is stored in a file called spaces in this filename located in the home directory."

Step 1 — List the home directory

Log in as bandit2, then list what's there:

ls
Enter fullscreen mode Exit fullscreen mode 
spaces in this filename
Enter fullscreen mode Exit fullscreen mode

Step 2 — Quote the filename

Wrap the whole name in double quotes so the shell treats it as a single argument:

cat "spaces in this filename"
Enter fullscreen mode Exit fullscreen mode 
[PASSWORD FOR bandit3]
Enter fullscreen mode Exit fullscreen mode

Step 3 — The escaped alternative

Backslash-escaping each space works identically, and is what shell tab-completion generates automatically:

cat spaces\ in\ this\ filename
Enter fullscreen mode Exit fullscreen mode 
[PASSWORD FOR bandit3]
Enter fullscreen mode Exit fullscreen mode

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Whenever a filename might contain spaces (or other shell-special characters), quote it or escape it — and when in doubt, let tab-completion do it for you instead of typing it by hand.

  • Unquoted spaces in the shell separate arguments, they don't stay part of one filename
  • Double quotes ("...") or single quotes ('...') both keep a filename intact
  • Tab-completion after typing a few letters auto-escapes special characters for you

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)