Our first misc challenge! This one felt reminiscent of overthewire’s Bandit series, which are a good introduction to the command line.<\/p>\n\n\n\n
GNU Coreutils are too bloated.\nThat's why minimalists use Busybox.\nBut the TRUE masters don't even need that.\n\nflag.txt is around here somewhere ~_~\nbut I lost it in this cluttered filesystem o_o\ncan you help me find it? UwU\n\n^-^ ls\nbash: ls: command not found<\/code><\/pre>\n\n\n\nSo, we’ve got nothing to work with besides bash builtins. This is gonna be hard! We unfortunately can’t mount the filesystem remotely, as the machine we ssh to isn’t the machine that the challenge is located on. <\/p>\n\n\n\n
sshfs noutil@chal.ctf-league.osusec.org:\/ ~\/temp\nnoutil@chal.ctf-league.osusec.org's password: \nremote host has disconnected<\/code><\/pre>\n\n\n\nSo! What do we have access to? Tab completion, for loops, echo, cd, variables, globbing, and functions. We can use these bash builtins to build some functionality that might be helpful.<\/p>\n\n\n\n
^-^ cd \/\n^-^ echo *\nbin dev etc home lib media mnt opt proc root run sbin srv sys tmp usr var<\/code><\/pre>\n\n\n\nOK, so echo *<\/code> is basically ls<\/code>. From here, we can start recursively jumping around directories and looking for a file named flag.txt<\/code>.<\/p>\n\n\n\nMost recursion requires a function that calls itself, so let’s start with that.<\/p>\n\n\n\n
function find {\n find;\n}<\/code><\/code><\/pre>\n\n\n\n\ud83d\udc4d<\/p>\n\n\n\n
Now simply write the necessary functionality!<\/p>\n\n\n\n
function find {\n for f in *;\n do if [[ -d $f && ! -L $f ]];\n then\n cd \"$f\";\n find;\n cd ..;\n elif [ $f == 'flag.txt' ] \n then \n echo `pwd`\/$f;\n fi;\ndone<\/code><\/pre>\n\n\n\nLine by line:<\/p>\n\n\n\n
function find {\n for f in *; # Loop through all files in current directory\n do if [[ -d $f && ! -L $f ]]; # If is a directory and not a symbolic link\n <\/code><\/pre>\n\n\n\nWe don’t want to follow symbolic links, as that could lead to infinite loops, as well as breaking our depth-first search.<\/p>\n\n\n\n
elif [ $f == 'flag.txt' ] \nthen \n echo `pwd`\/$f;\nfi;<\/code><\/pre>\n\n\n\nOur base case! This is pretty self explanatory.<\/p>\n\n\n\n
So, what does this function do when run? <\/p>\n\n\n\n
^-^ find\nbash: [: too many arguments\n\/usr\/lib\/share\/misc\/flag.txt<\/code><\/pre>\n\n\n\nNice! Let’s print it out by reading the contents and “executing” them. <\/p>\n\n\n\n
$(<\/usr\/lib\/share\/misc\/flag.txt)\nbash: osu{b4$h_i5_p1en7y}: command not found<\/code><\/pre>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
Our first misc challenge! This one felt reminiscent of overthewire’s Bandit series, which are a good introduction to the command line. So, we’ve got nothing to work with besides bash builtins. This is gonna be hard! We unfortunately can’t mount the filesystem remotely, as the machine we ssh to isn’t the machine that the challenge … Continue reading Writeup: no_util<\/span><\/a><\/p>\n","protected":false},"author":11809,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-138","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/users\/11809"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/comments?post=138"}],"version-history":[{"count":1,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/138\/revisions"}],"predecessor-version":[{"id":139,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/138\/revisions\/139"}],"wp:attachment":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/media?parent=138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/categories?post=138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/tags?post=138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}