Challenge description

Unlike every previous level, this one doesn't point at a specific directory at all — the password file could be anywhere on the server. The level description instead gives three properties to search the entire filesystem for.

Step 1 — Search from the filesystem root

Start the search at / instead of the home directory, since the file could be anywhere:

find / -user bandit7 -group bandit6 -size 33c

find: '/etc/ssl/private': Permission denied
find: '/var/lib/...': Permission denied
...
/var/lib/dpkg/info/bandit7.password
...

Step 2 — Suppress the permission errors

Most of the filesystem isn't readable by bandit6, so find prints a permission-denied line for every directory it can't enter. Redirect stderr to discard them and leave only the real result (and any other stdout matches) visible:

find / -user bandit7 -group bandit6 -size 33c 2>/dev/null

/var/lib/dpkg/info/bandit7.password

Step 3 — Read it

The matched path is readable despite living outside bandit6's home directory — dpkg (the Debian package manager) stores small per-package metadata files like this one, and this particular file's ownership happens to satisfy the puzzle's conditions:

cat /var/lib/dpkg/info/bandit7.password

[PASSWORD FOR bandit7]

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

A search scoped to the entire filesystem is noisy by default — most of it you don't have permission to even look inside. 2>/dev/null is the standard way to keep a command's real output while throwing away the error spam, and it's worth reaching for any time you deliberately search somewhere you only have partial access.

• find / searches starting from the filesystem root, not just the current directory
• -user and -group filter by file ownership, independent of each other
• 2>/dev/null redirects stderr (file descriptor 2) to discard it, leaving stdout untouched

Resources

• OverTheWire Bandit
• GNU findutils manual