Bandit 6 → 7: searching the whole filesystem, quietly

The first level where looking around doesn’t work. The file isn’t in your home directory, it’s somewhere on the server — which is a different kind of problem. You’re not looking in a place any more, you’re searching everywhere for something that matches a description.

This one took me several passes and a lot of arguing with an AI before it clicked.

the goal

The password for the next level is stored somewhere on the server and has all of the following properties: owned by user bandit7, owned by group bandit6, 33 bytes in size.

the approach

ls gives you nothing here, and I burned time on that before re-reading the objective properly. That was the actual unlock: the three properties aren’t flavour text, they’re the search query. Owner, group, size. The level is handing you the filter and asking if you know the tool that takes it.

find takes them as flags:

bandit6@bandit:~$ find / -user bandit7 -group bandit6

/ is where to start searching — the root of the filesystem, so, everywhere. And that’s the problem: running it as an unprivileged user means most of the filesystem answers back with Permission denied. Hundreds of lines of noise with the one line I wanted buried somewhere inside it.

That’s what 2>/dev/null is for:

bandit6@bandit:~$ find / -user bandit7 -group bandit6 2>/dev/null
/var/lib/dpkg/info/bandit7.password

One path back. cat it and the level’s done.

the takeaway

Two bricks out of this one, and the second is the one I actually came for.

find searches by description, not by name. -user, -group, -size 33c, -type f, -perm — every property in that objective maps to a flag. When a task says “somewhere on the server”, it’s a find task. (I only needed user and group to narrow it down here; -size 33c is there if the result comes back noisy.)

2>/dev/null throws away the errors, not the output. A program writes its normal output to stream 1 (stdout) and its complaints to stream 2 (stderr). They look identical on screen because both land in your terminal, but they’re separate pipes. 2> redirects stream 2 only, and /dev/null is a special file that discards anything written to it. So the permission errors go in the bin and the results survive.

That’s not a find feature. It works on any command that’s shouting at you while it works.