Bandit 5 → 6: three properties, one file

The level hands you three properties and hides one file among hundreds. The interesting part isn’t finding it — it’s that the three properties are not equally useful, and I picked the weakest one on purpose.

the goal

The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties: human-readable, 1033 bytes in size, not executable.

the approach

inhere isn’t one directory this time. It’s twenty of them:

bandit5@bandit:~$ cd inhere
bandit5@bandit:~/inhere$ ls
maybehere00  maybehere02  maybehere04  ...  maybehere19

I opened one first to see what a single directory looks like before doing anything clever:

bandit5@bandit:~/inhere$ ls -la maybehere00

Ten or so files each, some of them hidden — which is why -a matters here. Times twenty directories, that’s a couple of hundred files. Too many to eyeball, which is the whole point of the level.

So I had opencode write me a loop to list all of them at once:

bandit5@bandit:~/inhere$ for d in maybehere*; do
>   echo "== $d"
>   ls -la "$d"
> done

That prints every file in every directory with its permissions. And in that wall of output one line doesn’t match the others — almost everything carries an x in the permission column, and one file in maybehere07 doesn’t. Not executable. cat it and there’s the password.

taking the long way on purpose

The AI offered me two better routes before that one: filter on the 1033-byte size, or hand the whole thing to find with the properties as flags. I turned both down.

That was deliberate. I’m training myself to use the CLI with an AI as a script-writer, not a solver — it writes the syntax, I do the connecting. Taking the size filter would have meant it found the file and I watched. So I got the loose filter and the slower solve, and in exchange the thinking stayed mine. Worth being clear that it was a choice, not a limitation.

the takeaway

The three properties the level gives you are not equally good filters, and noticing which is which is the actual skill.

• human-readable — narrows it a bit, most of these files aren’t.
• not executable — the loosest of the three. Plenty of files aren’t executable. It only worked here because the level made almost everything else executable on purpose.
• 1033 bytes — the one that’s genuinely unique. Exactly one file in that tree is exactly that size.

Given a list of properties, look for the one that’s most specific and start there. find takes all three at once, which is where this goes next:

find inhere -type f -size 1033c ! -executable

-size 1033c means exactly 1033 bytes — the c is what makes it count bytes rather than 512-byte blocks, and forgetting it is the classic mistake.