Lab 02 — Bandit 0 to 5: your first shell on someone else’s machine

Level 0 asks one thing: log in. The credentials for this first level are published on OverTheWire's own site as the front door — username bandit0, password bandit0. Everything after this you find yourself.

$ ssh bandit0@bandit.labs.overthewire.org -p 2220

the first time, you get asked about a fingerprint

The authenticity of host '[bandit.labs.overthewire.org]:2220 ...' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Read the command left to right. ssh is the client. bandit0@ is who you are logging in as. Then the hostname. Then -p 2220, which matters more than it looks — SSH normally listens on port 22, and leaving that flag off is the single most common reason this first step fails for people. If you get connection refused, that is almost always what happened.

About that fingerprint prompt. Your machine has never spoken to this server before, so it is showing you the server's public key and asking whether you trust it. Type yes. In a real engagement you would verify that fingerprint against a value you were given out of band, because accepting blindly is exactly how a machine-in-the-middle succeeds. Here the risk is nil, but notice that the prompt is a security decision and not a formality.

Your password will not appear as you type it. No dots, no asterisks, nothing. The terminal is not frozen and your keyboard is not broken. Type it and press enter.

Level 0 to 1 is the gentlest one in the game: the next password sits in a file named readme in your home directory. Two commands do it.

$ ls -la

then read what you found

$ cat readme

Why -la and not bare ls. The -l gives you the long form: permissions, owner, group, size, modification date. The -a includes entries beginning with a dot, which Unix hides by convention. Get into the habit now — you will need -a in step 05, and the owner and size columns from -l are what levels 6 and 7 are built around.

Write the password down before you do anything else. Then log out with exit and come back in as bandit1. Every level works this way: the password you find is the login for the next user, on the same host and the same port.

The next file is called -. Just a hyphen. Try the obvious thing first, because the way it fails is the lesson.

$ cat ./-

run a bare  cat -  first and watch it sit there doing nothing.
press Ctrl-C to get out, then run the command above.

What just happened. A bare - is a long-standing Unix convention meaning standard input rather than a filename. So cat - does exactly what you asked: it waits for you to type something. It is not hung, it is listening.

The fix, and why it generalises. ./ means “in the current directory”. Putting it in front turns the argument into an unambiguous path, and a path is never mistaken for a flag. The same trick saves you whenever a filename starts with a hyphen — which, notably, is also how a certain class of command-injection bug gets started when a program builds a command line out of filenames it did not choose.

This one is called --spaces in this filename--. Two problems at once: it opens with hyphens, and it contains spaces, which the shell treats as the boundary between one argument and the next.

$ cat "./--spaces in this filename--"

or let the shell do the typing for you

$ cat ./--spa<TAB>

Two fixes, both worth knowing. Quoting the whole thing tells the shell to treat it as one argument, spaces and all. Backslash-escaping each space does the same job more painfully. And tab completion does it for you: type the first few characters and press Tab, and the shell fills in the rest correctly escaped. Use Tab constantly — it is faster and it does not make typos.

The real lesson is about the shell, not the file. Nothing here is a trick. The shell splits your line into words before the command ever sees it, and every one of these levels is really asking whether you understand that. Once you do, quoting stops being something you memorise.

Now there is a directory called inhere, and the file you want inside it is hidden. You already have the flag for this from step 02.

$ cd inhere && ls -la

“Hidden” is a convention, not a permission. A file whose name starts with a dot is omitted by ls and by shell globbing, and that is the entire mechanism. It is not encrypted, not protected, not access-controlled. Anyone who types ls -a sees it.

Why this matters beyond the game. Dotfiles are where configuration and credentials live — .ssh, .aws, .git, .env. Somebody who thinks a leading dot is security is one ls -a away from finding out otherwise, and on a real host that is frequently where the interesting things are.

The last level in this run puts a pile of files in inhere and tells you only one of them is human-readable. Resist the urge to cat them one at a time — several are binary, and dumping binary to a terminal will scramble it.

$ file ./*

one of these is not like the others

./-file00: data
./-file01: data
./-file07: ASCII text
...

file reads the contents, not the name. It looks at the opening bytes and matches them against a database of known signatures. That is why it can tell you something is a PNG when it has been renamed to .txt, and it is the same reasoning behind a good deal of malware triage. Extensions are a suggestion; magic bytes are evidence.

If your terminal does get scrambled — garbage characters, wrong colours, keyboard producing nonsense — type reset and press enter. It will look like nothing is happening as you type. It usually works anyway.

Note the ./ again. The filenames here start with hyphens too. Step 03 was not a one-off; it was preparation.