I've just completed OverTheWire Bandit wargame, level 18.That was a surprise. Here are the instructions for this level.The password for the next level is stored in a file readme in the  homedirectory. Unfortunately, someone has modified .bashrc to log you  out when you log in with SSH.I was thinking of a way to have the shell skip sourcing .bashrc. But before I found out a solution, I got tempted into simply starting an SFTP connection with the server. I didn't expect it to work. But it did. And I would like to know why. I thought SFTP runs over SSH.For clarity, when I SSH into the server, I get kicked out, as expected.
In what way isn't SFTP based on SSH?
ssh;sftp
On bash in generalBash's design with respect to startup files is rather peculiar. Bash loads .bashrc in two unrelated circumstances:When it's an interactive shell, except when it's a login shell (and except when it's invoked as sh). This is why .bash_profile typically loads .bashrc.When bash is not interactive nor a login shell nor invoked as sh but given a command to execute with -c and SHLVL is unset or less or equal to 1, and one of the following is true:If standard input is a socket. In practice, this mostly happens when bash is invoked by rshd, i.e. when running rsh remotehost.example.com somecommand.If activated at compile time (which is the case on some distributions, such as Debian and derivatives), if one of the environment variables SSH_CLIENT or SSH2_CLIENT is defined. In practice, this means that bash is invoked by sshd, i.e. ssh remotehost.example.com somecommand.If you don't know how bash was compiled, you can find out whether this option was set by checking whether the binary contains the string SSH_CLIENT:strings /bin/bash | grep SSH_CLIENTOn SSH in generalWhen you execute a command through the SSH protocol, the command is passed over the wire as a string. The string is executed by the remote shell. When you run ssh example.com somecommand, if the remote user's login shell is /bin/bash, the SSH server runs /bin/bash -c somecommand. There is no way to bypass the login shell. This permits restricted login shells, for example to allow only file copying and not general command execution.There is one exception: the SSH protocol allows the client to request a specific subsystem. If the client requests the sftp subsystem, then by default the OpenSSH server invokes the program /usr/lib/openssh/sftp-server (the location may vary) via the user's login shell. But it can also be configured to run an internal SFTP server through the lineSubsystem sftp internal-sftpin the sshd_config file. In the case of the internal SFTP server, and only in this case, the user's login shell is bypassed.For this challengeIn the case of OverTheWire Bandit 18, .bashrc contains# If not running interactively, don't do anythingcase $- in    *i*) ;;      *) return;;esacecho 'Byebye !'exit 0So you can solve this level by doing anything that causes bash not to be interactive. As you discovered, SFTP works. But ssh bandit18@bandit.labs.overthewire.org cat readme would also work. As would echo 'cat readme' | ssh bandit18@bandit.labs.overthewire.org. And pressing Ctrl+C at the right time during an interactive login would also work: it would interrupt bash, so the .bashrc would not be completely executed. Bash takes macroscopic time to start up, so while this doesn't work reliably, it can be done in practice.  