OverTheWire Bandit Level 12 to Level 13: From Hex Dump to Password!

Welcome back to my OverTheWire Bandit series! In the previous article, we solved Bandit Level 0 → Level 12, where we learned lots of techniques in Linux.

In this article, we'll tackle Bandit Level 12 → Level 13, one of the most engaging levels in the Bandit wargame. This challenge introduces us to hex dumps, file identification, and extracting data from multiple layers of compressed archives using essential Linux command-line tools. Instead of relying on guesses, we'll learn how to analyze files methodically and uncover the password step by step.

A little note before we begin: I am also a beginner who is learning Linux and cybersecurity step by step. This walk-through is based on my own learning experience while solving the OverTheWire Bandit challenges.

I am documenting my journey to help other beginners who are starting from the same point. If you are also new to Linux, command-line tools, or cybersecurity, I hope my explanations make these challenges easier to understand.

Let's learn and improve together!

First things first, login to the bandit server using:

ssh [e-mail] -p 2220

and previous level flag as the password.

Step 1: List the Files

After logging in to the Bandit server, I always start by listing the files in the current directory using ls command. This simple habit helps me understand what files are available and where I should begin.

In here, there is a single file named data.txt. This file contains the challenge data that we'll work with throughout this level. I tried to read the file using cat command.

As you can see, this file is a hex dump of another file.
This means we have to work with this file many times.

Step 2: Create a Temporary Directory

Since we will be modifying and extracting the file multiple times, it is better to work inside a temporary directory. Linux provides the mktemp command for creating temporary files and directories safely.

In this case I created a temporary directory using:

mktemp -d

and change current directory to that temporary directory.

cd {directory}

Step 3: Copy the Original File

I created a copy of the original file in this directory.

cp ~/data.txt .

In here the '.' means current directory. So, this means I created a copy of the data.txt file, which is located in root directory, into my current directory.

I changed the file name to "hexdump" for better view.

Step 4: Reversing the Hex Dump File

In this case, we have to use the xxd tool to reverse the hexdump file to its original form (Binary form).

xxd -r hexdump {new_name}

As you can see here, there is a new file and it is the original binary form of this file. But it is still compressed!

xxd - tool for creating and reading hex dumps.
-r - reverse the hex dump back into binary.

Step 5: Decompress the File (gzip)

Looking at the first line, we see that these are the first bytes of the file. Quick google search told me that this is a gzip compressed file.

For decompress this file We have to add the correct ending to the file. In here it is .gz. So, I renamed the file and decompress it using gzip -d command.

Step 6: Decompress the File Again (bzip2)

I read the new hex dump using xxd command.

After searching the first bytes on the google, shows that it is a bzip version 2 compressed file.

Again we have to change the file name with the correct ending to decompress this, in here it is .bz2. For decompressing I used bzip2 -d command.

Step 7: Decompress the File Again (gzip)

This is a tricky one. Because after check the file using xxd, it shows again this is a gzip compressed file.

Here's the thing. This file is compressed multiple times, not only once. So you have to rename and decompress using correct tool every time until you reach the end point.

Step 8: Extract the File

After decompress all the way to the end. I get an tar file.

Again I renamed the filename to the correct ending form, which is .tar and extract the file using tar -xf command. After extracting I listed the files using ls and found a new file called data5.bin.

Then again I read the hex dump using xxd command and found it is also a tar file. Rename again with .tar and used tar -xf command to extract it. After extracting, another file named data6.bin appeared.

Step 9: Decompress the New File (bzip2)

Then I read the hex dump of the new data6.bin file using xxd command and found that it is a bzip version 2 compressed file again.

Then I renamed the filename to data6.bz2 and decompressed it using bzip2 -d command.

Then I checked again the hex dump value of the decompressed file and it is a tar file again.

Step 10: Extract the File Again

Renamed the filename to data6.tar and extracted it using tar -xf command. It created a new file named data8.bin.

Step 11: Decompress the New File (gzip)

Again read the hex dumb of the new file and it was a gzip compressed file again. So, I repeated the same method I used before.

Step 12: Final Step

After decompressing, I read the hex dump of the file again and finally our file is fully decompressed to the end!

Use cat command to read the file!

Summary

In this level, we learned how to work with a file that was stored as a hex dump. We first created a temporary workspace, copied the file, and then converted the hex dump back into its original binary format using xxd -r.

After restoring the file, we used first 8 bytes of the hex dump to identify its type and extracted multiple layers of compressed data until we found the password for the next level.

This challenge helped us understand the importance of analyzing files step by step instead of guessing. We learned how Linux tools like xxd and different extraction commands can be used together for file analysis.

This is a walk-through by a real beginner, for beginners. I hope my learning process and explanations help you understand the challenges and improve your own skills. If you find any mistakes or have suggestions for improvement, please let me know. I am still learning, and your feedback helps me grow.