DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

OverTheWire Bandit Level 6 Writeup — Search the Whole Filesystem by Owner and Size

#ctf #security #beginners

The password file lives somewhere on the whole filesystem, not in the home directory — find / filtered by owning user, owning group, and exact size locates it, with stderr suppressed to hide permission-denied noise.

  • Platform: OverTheWire Bandit
  • Category: Linux Fundamentals
  • Level: 6 → 7
  • Difficulty: Beginner
  • Technique: filesystem-wide find with -user/-group/-size

Challenge description

Unlike every previous level, this one doesn't point at a specific directory at all — the password file could be anywhere on the server. The level description instead gives three properties to search the entire filesystem for.

"Level Goal: The password for the next level is stored somewhere on the server and has all of the following properties: owned by user bandit7, owned by group bandit6, 33 bytes in size."

Step 1 — Search from the filesystem root

Start the search at / instead of the home directory, since the file could be anywhere:

find / -user bandit7 -group bandit6 -size 33c
Enter fullscreen mode Exit fullscreen mode 
find: '/etc/ssl/private': Permission denied
find: '/var/lib/...': Permission denied
...
/var/lib/dpkg/info/bandit7.password
...
Enter fullscreen mode Exit fullscreen mode

Step 2 — Suppress the permission errors

Most of the filesystem isn't readable by bandit6, so find prints a permission-denied line for every directory it can't enter. Redirect stderr to discard them and leave only the real result (and any other stdout matches) visible:

find / -user bandit7 -group bandit6 -size 33c 2>/dev/null
Enter fullscreen mode Exit fullscreen mode 
/var/lib/dpkg/info/bandit7.password
Enter fullscreen mode Exit fullscreen mode

Step 3 — Read it

The matched path is readable despite living outside bandit6's home directory — dpkg (the Debian package manager) stores small per-package metadata files like this one, and this particular file's ownership happens to satisfy the puzzle's conditions:

cat /var/lib/dpkg/info/bandit7.password
Enter fullscreen mode Exit fullscreen mode 
[PASSWORD FOR bandit7]
Enter fullscreen mode Exit fullscreen mode

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

A search scoped to the entire filesystem is noisy by default — most of it you don't have permission to even look inside. 2>/dev/null is the standard way to keep a command's real output while throwing away the error spam, and it's worth reaching for any time you deliberately search somewhere you only have partial access.

  • find / searches starting from the filesystem root, not just the current directory
  • -user and -group filter by file ownership, independent of each other
  • 2>/dev/null redirects stderr (file descriptor 2) to discard it, leaving stdout untouched

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)