Create Workstation Virtual Machine Using Existing Virtual Disks


When I download certain Virtual Machines (VM) from the internet, be it for research or practice purposes, sometimes it only comes with a Virtual Machine Disk (VMDK).

VMDK is a form of file format that describes containers for virtual hard disk drives to be used by VM such as VMware Workstation.

The problem is that when you tried to open the VMDK file on your VMware Workstation, it prompts you that the Virtual Machine Configuration (VMX) file is missing, corrupted or deleted.

To solve this issue, you need to create a new VM from scratch and do the setup by hooking it up with the existing VMDK file.

  1. In Workstation, go to File > New > Virtual Machine.
  2. Select Custom and click Next.
  3. Select the hardware compatibility you require and click Next.
  4. In the Guest Operating System Installation selection screen, select I will install the Operating System later and click Next.
  5. Provide a file name and choose the location where you want to save the virtual machine and click Next.
  6. Select the desired networking type for your virtual machine and click Next.
  7. Select Use an Existing Virtual Disk and click Next.
  8. Click Browse and navigate to the location of your existing .vmdk file and click Next.
  9. Review the settings displayed in the Summary window and click Finish.

Hope this helps!

OverTheWire: Bandit Level 25 to Level 26

Level goal: Logging in to bandit26 from bandit25 should be fairly easy… The shell for user bandit26 is not /bin/bash, but something else. Find out what it is, how it works and how to break out of it.

Indeed, logging in is easy, simply run the usual command which allow you to login using SSH key instead of login credentials

ssh -i bandit26.sshkey [email protected]


However, after you logged into bandit26, you will be logged out immediately, “Connection to localhost closed.”

As hinted by the question, let’s take a look at the bash used by bandit26,

[email protected]:~$ cat /etc/passwd | grep bandit26
 bandit26:x:11026:11026:bandit level 26:/home/bandit26:/usr/bin/showtext

Instead of /bin/bash, bandit26 is using /usr/bin/showtext, which is apparently not a shell. Let’s look at the content of the file

[email protected]:~$ cat /usr/bin/showtext
 more ~/text.txt
 exit 0

The way to obtain the password for this level is extremely creative, I salute the team who designed this portion of the challenge, it’s really good.

As we know, we will be logged out immediately after we gain access to the server using the SSH key. The way to get the level 27 password is to gain access to the file before your shell gets terminated.

Think about it, how can that be possibly done? The hint is that you are able to “log in” to the system, just that when it spawns a shell, it terminates the shell immediately – the exact code is “exit 0” as we have see in the showtext “shell”.

Here’s the solution:

First, minimize your terminal so that when you are logged into bandit26 via ssh command, the large “bandit26” ASCII art banner will force a “more” message to prompt you to continue the output. You may refer to the screenshot as an illustraton of how I have minimized my terminal,


ssh -i bandit26.sshkey -t [email protected] cat text.txt


Now that you have forces the terminal to prompt you to continue the display via “more” or “–More–(50%)” in this case, press “v” to enter “vim”, a built-in text editor on Unix machines. You will see the output as per below,


Now, press “:e /etc/bandit_pass/bandit26” to edit the password file of bandit26.


There you go, you have the password to proceed to level 27!!

Let’s review what we have done. We have forces the terminal to display a “more” output, where we can open a VIM text editor and open the password file of bandit26 using the file opening command within the VIM text editor. We are able to open this password file containing the bandit26 password because we have logged into the bandit26 account and this is right before the “exit 0” portion of the code boot us out from the machine.

The password to gain access to the next level is 5czgV9L3Xx8JPOyRbXh6lQbmIOWvPT6Z. However, level 27 is not up yet, therefore level 26 is the final bandit challenge as of now.

OverTheWire: Bandit Level 24 to Level 25

Level goal: A daemon is listening on port 30002 and will give you the password for bandit25 if given the password for bandit24 and a secret numeric 4-digit pincode. There is no way to retrieve the pincode except by going through all of the 10000 combinations, called brute-forcing.


The following is my script to perform this brute-forcing techqnies,




while [ $pin -lt 10000 ]; do

echo “Attempting PIN: $pin”

attempt=”$(echo $pass24 $pin | nc localhost 30002)”

if ! [[ $attempt == *”Wrong!”* ]]; then

echo -ne “$attempt”





The script will iterate through each possible PIN to perform brute forcing in identifying the secret pincode of bandit25.


The password to gain access to the next level is uNG9O58gUE7snukf3bvZ0rxhtnjzSGzG.

OverTheWire: Bandit Level 23 to Level 24

Level goal: A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

NOTE: This level requires you to create your own first shell-script. This is a very big step and you should be proud of yourself when you beat this level!

NOTE 2: Keep in mind that your shell script is removed once executed, so you may want to keep a copy around…

As usual for levels which require us to write, you have to create your own file directory in /tmp and then create a script which output the password file there, and then move it over to the /var/spool/$myname directory



cat /etc/bandit_pass/bandit24 >> /tmp/kongwenbin23/bandit24pass

Important: remember to change the permission of your script before copying it to the /var/spool/bandit24 folder or it will not be run by the bandit24 account. It took me a few tries to notice it.


The scripts in /var/spool/bandit24 will be run once and then purged away every minute.


The password to gain access to the next level is UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ.


Fun fact: you can solve this level using the exact same method as the previous level, must have been a “loophole”…


OverTheWire: Bandit Level 22 to Level 23

Level goal: A program is running automatically at regular intervals from cron, the time-based job scheduler. Look in /etc/cron.d/ for the configuration and see what command is being executed.

NOTE: Looking at shell scripts written by other people is a very useful skill. The script for this level is intentionally made easy to read. If you are having problems understanding what it does, try executing it to see the debug information it prints


Like what we have done in the previous level, let’s navigate to the /etc/cron.d path and check the cronjob files.

Notice that cronjob_bandit23 is will be running the /usr/bin/ script? Let’s view its content.

[email protected]:/etc/cron.d$ cat /usr/bin/

mytarget=$(echo I am user $myname | md5sum | cut -d ' ' -f 1)

echo "Copying passwordfile /etc/bandit_pass/$myname to /tmp/$mytarget"

cat /etc/bandit_pass/$myname > /tmp/$mytarget


Yes, you have guessed correct. When this script is being run, it will write the currently logged-on user’s password into a file.


The file name is basically a md5 hash of “echo I am user bandit22 | md5sum | cut –d ‘ ‘ –f 1”

Since we need the password of bandit23, let’s manually run the hash and use its hash as the directory name. The password might be there, provided that someone with the bandit23 credentials has already ran this script (they probably have).


The password to gain access to the next level is jc1udXuA1tiHqjIsL8yaapX5XIAI6i0n.