Bandit Level 9 to 10: Sifting Through Binary Data with 'strings'

Introduction

In our journey so far, we’ve dealt mostly with plain text files. Bandit Level 9 to 10 introduces a new type of challenge: extracting information from a binary file. These files are compiled for machines, not humans, and reading them with cat results in a mess of unreadable characters.

This level teaches us how to use the strings command, a specialized tool for finding and printing the sequences of readable text embedded within binary data. 🧐

The Challenge: Level 9 Goal

The objective for this level is stated as:

The password for the next level is stored in the file data.txt and is one of the only human-readable strings, preceded by several ‘=’ characters.

We have a binary file, data.txt, and a clear hint: look for a line starting with equal signs.

Step-by-Step Walkthrough

Let’s pull that readable password out of the binary mess.

Step 1: Log into bandit9

Use the unique password you discovered in the last level to SSH into bandit9.

ssh [email protected] -p 2220

Step 2: Investigate data.txt

First, confirm the file exists with ls. Then, to understand why we can’t use cat, try it and see the garbled output.

ls
# data.txt
cat data.txt
# ^?ELF^B^A^A^@^@^@^@^@^@^@^@^@^C^@>^@^A^@^@^@p... (and so on)

This is clearly not a plain text file.

Step 3: The Solution - The strings Command

The strings command is designed specifically for this situation. It scans any file (binary or not) and prints out sequences of printable characters it finds.

Let’s run it on our file.

strings data.txt

This will produce a lot of output, but it’s all readable text! The password is in this list somewhere. Manually scrolling through it is possible, but not efficient.

/lib64/ld-linux-x86-64.so.2
libc.so.6
__libc_start_main
GLIBC_2.2.5
...
========== the password is ...
...
and lots of other text

Step 4: Refining the Search with grep

We have a clue: the password is on a line preceded by several = characters. This is a perfect job for a grep pipeline! We can send the output of strings directly to grep and filter for our pattern.

Let’s search for lines containing ====.

strings data.txt | grep "===="

This command elegantly filters all the junk and gives us the exact line we need.

========== the
========== password
E========== is
5========== FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey

The password for bandit10 is the string of text on that line.

–

Key Concepts Learned

1. Binary Files: We learned that many files on a Linux system are not plain text and require special tools to inspect.
2. strings Command: This is the key takeaway. strings is an essential utility for initial analysis of an unknown binary file in forensics and reverse engineering to find embedded text like configuration details, error messages, or hidden passwords.
3. Refining Pipelines: This level reinforces the power of chaining commands. The strings | grep combination is a very common and effective pattern for finding specific information inside binary files.

Conclusion

You’ve successfully peered into a binary file and extracted the secret hidden within. This skill is a stepping stone into more advanced topics like reverse engineering.

Copy the password you found and get ready to tackle the next level!