OverTheWire Bandit Level 5 Writeup — Find a File by Size, Type, and Permissions

The password file inside inhere is the only one that is human-readable, exactly 1033 bytes, and not executable — find filters for all three at once.

• Platform: OverTheWire Bandit
• Category: Linux Fundamentals
• Level: 5 → 6
• Difficulty: Beginner
• Technique: find with combined size/type/permission filters

Challenge description

Level 5's home directory contains a directory called inhere, which itself contains many subdirectories, each full of decoy files. Manually opening every one isn't realistic — the level gives three exact properties the real file satisfies.

"Level Goal: The password for the next level is stored in the file data.txt, which is located in one of the many, many directories that live at /home/bandit5/inhere. The file is: human-readable, 1033 bytes in size, not executable."

Step 1 — See the scale of the problem

Log in as bandit5 and look at what's inside inhere:

cd inhere
find . -type f | wc -l

(a large number — dozens of nested directories, each holding several decoy files)

Step 2 — Filter by size

The level gave an exact byte count — use it directly rather than opening files one by one:

find . -size 1033c

./maybehere07/.file2
(and possibly a few other candidates)

Step 3 — Add the type and permission filters

Combine all three stated properties — regular file, that exact size, and not executable — into a single find command to narrow to exactly one result:

find . -type f -size 1033c ! -executable

./maybehere07/.file2

Step 4 — Read it

Cat the single remaining candidate:

cat ./maybehere07/.file2

[PASSWORD FOR bandit6]

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

When a task description gives you specific, checkable properties instead of a name or location, that's a hint to filter for them directly rather than browse manually. find's flags compose — stacking -size, -type, and a permission test narrows a huge haystack down to one file in a single command.

• find . -size 1033c matches files of an exact size, in bytes (the trailing c means bytes)
• ! -executable negates a test — here, "not executable"
• Stacking multiple find conditions together narrows results fast, without opening a single file by hand

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.