OverTheWire Behemoth Level 0 → 1 tutorial!!

Login

ssh behemoth0@behemoth.labs.overthewire.org -p 2221
# password: behemoth0

Why? Each Behemoth level is a separate UNIX user. To solve 0 → 1, you must log in as behemoth0.

Task

There is a binary called /behemoth/behemoth0. It asks for a password and if correct, escalates you to behemoth1 (via setuid).

Our mission: discover the correct password.

A little bit of Theory

• ltrace shows dynamic library calls invoked by the binary (e.g. strcmp, scanf, puts). Perfect for spotting hidden string comparisons.
• Hardcoded checks often use strcmp(user_input, "secret"). With ltrace you can directly see the string.
• If ltrace is not installed, strings can also reveal embedded plaintext passwords.

Further reading:

• ltrace manual
• strcmp manual

Solution

1. Run the binary normally

   cd /behemoth
   ./behemoth0
   Password: test
   Access denied..
   

   → It clearly expects a special password.

2. Trace with ltrace

   ltrace ./behemoth0
   

   Simplified output:

   printf("Password: ")
   __isoc99_scanf(...)
   strcmp("test", "eatmyshorts") = -1
   puts("Access denied..")
   

   👉 The password check is comparing against eatmyshorts.

3. Use the discovered password

   ./behemoth0
   Password: eatmyshorts
   Access granted..
   whoami
   # behemoth1
   

   ✅ We are now running as behemoth1.

4. Grab the password for next level

   cat /etc/behemoth_pass/behemoth1
   

   Output:

   aesebootiv
   

Password

aesebootiv

Troubleshooting

• ltrace: command not found → fallback: strings /behemoth/behemoth0 | grep -i short.
• No strcmp output → enter dummy input to trigger comparison.
• Still “Access denied” → check for typos (must be exact match).
• Permission denied reading file → confirm whoami = behemoth1.

Copy-paste quick run

cd /behemoth && ltrace ./behemoth0
# → reveals password "eatmyshorts"

echo eatmyshorts | ./behemoth0
whoami
cat /etc/behemoth_pass/behemoth1

Congrats 🎉 You successfully leaked the hardcoded password using ltrace, escalated to behemoth1, and grabbed the next password!

Thanks for reading!

Until next time — Otsumachi!! 💖☄️✨