RingZero CTF - Forensics - I Love cat

RingZero CTF - Forensics - I Love cat


Objective:

I love cat! Do you?

User: cat
Password: cat

ssh challenges.ringzer0team.com port 10252

Solution:


So let's start up and SSH to challenges.ringzer0team.com on port 10252

Login as            cat
pass                  cat


Lets start by seeing what is in our directory

cat@lxc-forensics-252:~$ ls
commands  flag.txt

is it as easy as just catting the flag.txt file?

cat@lxc-forensics-252:~$ cat flag.txt

**************************** WHERE IS THE FLAG ? ****************************

Nope lets see what else is in the directory

cat@lxc-forensics-252:~$ ls -al

total 20

drwxr-xr-x 3 root root 4096 Jul 17 18:36 .

drwxr-xr-x 3 root root 4096 Jul 17 18:23 ..

-rw-r--r-- 1 root root  221 Jul 17 18:30 .bash_profile

drwxr-xr-x 2 cat  cat  4096 Jul 17 18:25 commands

-rw-r--r-- 1 root root  116 Jul 17 18:36 flag.txt

a directory name commands

cat@lxc-forensics-252:~$ cd commands/

-rbash: cd: restricted

lets try to ls the directoy
cat@lxc-forensics-252:~$ ls ./commands/

cat  ls

ok we only can use cat and LS

let's check out  the cat man to see if we might get some help there

http://man7.org/linux/man-pages/man1/cat.1.html

CAT(1)                          User Commands                         CAT(1)

NAME         top

       cat - concatenate files and print on the standard output

SYNOPSIS         top

       cat [OPTION]... [FILE]...

DESCRIPTION         top

       Concatenate FILE(s) to standard output.

       With no FILE, or when FILE is -, read standard input.

       -A, --show-all
              equivalent to -vET

CAT(1)                          User Commands                         CAT(1)


NAME         top
       cat - concatenate files and print on the standard output


SYNOPSIS         top
       cat [OPTION]... [FILE]...


DESCRIPTION         top
       Concatenate FILE(s) to standard output.

       With no FILE, or when FILE is -, read standard input.

       -A, --show-all
              equivalent to -vET


That -A looks interesting 


Let's try cat with -A on flag.txt




cat@lxc-forensics-252:~$ cat -A flag.txt
FLAG-0K14eDrm4t5g7KD54X8Dl3NNcZ956oCK^M**************************** WHERE IS THE FLAG ? ****************************$





Bam we got the flag


FLAG-0K14eDrm4t5g7KD54X8Dl3NNcZ956oCK