Magikarp Ground Mission
is a general skills puzzle worth 30 points. The description is as follows:
Do you know how to move between directories and read files in the shell? Start the container, `ssh` to it, and then `ls` once connected to begin. Login via `ssh` as `ctf-player` with the password, `481e7b14`
This challenge was straightforward. It had pieces of the flag in three different files, and instructions of where to get the pieces. Below is my session solving this puzzle:
% ssh ctf-player@venus.picoctf.net -p 58785 The authenticity of host '[venus.picoctf.net]:58785 ([3.131.124.143]:58785)' can't be established. ECDSA key fingerprint is SHA256:NrQkIxNEQQho/GA7jE0WlIa7Jh4VF9sAvC5awkbuj1Q. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[venus.picoctf.net]:58785,[3.131.124.143]:58785' (ECDSA) to the list of known hosts. ctf-player@venus.picoctf.net's password: Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 5.4.0-1041-aws x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. ctf-player@pico-chall$ ls 1of3.flag.txt instructions-to-2of3.txt ctf-player@pico-chall$ cat instructions-to-2of3.txt Next, go to the root of all things, more succinctly `/` ctf-player@pico-chall$ cat 1of3.flag.txt picoCTF{xxsh_ ctf-player@pico-chall$ ls / 2of3.flag.txt boot etc instructions-to-3of3.txt lib64 mnt proc run srv tmp var bin dev home lib media opt root sbin sys usr ctf-player@pico-chall$ cat /2of3.flag.txt 0ut_0f_\/\/4t3r_ ctf-player@pico-chall$ cat /instructions-to-3of3.txt Lastly, ctf-player, go home... more succinctly `~` ctf-player@pico-chall$ ls -al ~ total 32 drwxr-xr-x 1 ctf-player ctf-player 4096 Aug 24 00:31 . drwxr-xr-x 1 root root 4096 Mar 16 06:12 .. drwx------ 2 ctf-player ctf-player 4096 Aug 24 00:31 .cache -rw-r--r-- 1 ctf-player ctf-player 80 Mar 16 06:12 .profile drw------- 1 ctf-player ctf-player 4096 Mar 16 06:12 .ssh -rw-r--r-- 1 ctf-player ctf-player 10 Mar 16 06:12 3of3.flag.txt drwxr-xr-x 1 ctf-player ctf-player 4096 Mar 16 06:12 drop-in ctf-player@pico-chall$ cat ~/3of3.flag.txt 1118a9a4} ctf-player@pico-chall$ Connection to venus.picoctf.net closed by remote host. Connection to venus.picoctf.net closed.
Piecing these three files together yields the flag.
Pingback: picoCTF Writeups – DMFR SECURITY