🐉 neospace ~

📝 Latest Posts

SansAlpha

Feb 13, 20256 min read

Description

The Multiverse is within your grasp! Unfortunately, the server that contains the secrets of the multiverse is in a universe where keyboards only have numbers and (most) symbols.ssh -p 64396 ctf-player@mimas.picoctf.netUse password: 6dd28e9b

Steps :

╰─❯ ssh -p 64396 ctf-player@mimas.picoctf.net                                ─╯
ctf-player@mimas.picoctf.net's password:
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 6.5.0-1016-aws x86_64)
 
 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage
 
This system has been minimized by removing packages and content that are
not required on a system that users do not log into.
 
To restore this content, you can run the 'unminimize' command.
Last login: Thu Feb 13 12:28:24 2025 from 127.0.0.1
SansAlpha$ ls
SansAlpha: Unknown character detected
SansAlpha$ cat
SansAlpha: Unknown character detected
SansAlpha$

img

looks like something different, so i research about how to navigate on bash without english keywords by only numbers and special characters. i found the wildcards : https://tldp.org/LDP/GNU-Linux-Tools-Summary/html/x11655.htm

so tried *,

SansAlpha$ *
bash: blargh: command not found
 
SansAlpha$ */
bash: blargh/: Is a directory
 
SansAlpha$ /*/*
/bin/[: missing ']'
 
SansAlpha$ ./*
bash: ./blargh: Is a directory
 
SansAlpha$ ./*/
bash: ./blargh/: Is a directory
 
SansAlpha$ ./*/*
bash: ./blargh/flag.txt: Permission denied

so flag on /blargh/flag.txt

------- (after 2 hours)--------

SansAlpha$ ls
SansAlpha: Unknown character detected
SansAlpha$ /*
bash: /bin: Is a directory
 
SansAlpha$ /*/*
/bin/[: missing ']'
 
SansAlpha$ /???/*
/bin/[: missing ']'
 
SansAlpha$ /???/???
E: Invalid operation /bin/awk

so found this /bin/awk, while researching about awk i found that we can use awk as same as cat. awk '$0' filename.txt

Pattern: 0 refers to the entire line, and since a non-empty line will always evaluate to true, it causes awk to perform the default action, which is to print the entire line.

This means that awk ‘$0’ filename.txt is just printing all the lines in the file, much like running cat filename.txt.

more about [[Understanding $0 in awk]] >>> so i tried to call awk and pass the flag.txt to print the flag :

SansAlpha$ /*
bash: /bin: Is a directory
 
SansAlpha$ /???/?*
/bin/[: missing ']'
 
SansAlpha$ /???/???
E: Invalid operation /bin/awk
 
SansAlpha$ ./*
bash: ./blargh: Is a directory
 
SansAlpha$ ./*/*
bash: ./blargh/flag.txt: Permission denied
 
SansAlpha$ /???/??? ./*/*
E: Invalid operation /bin/awk

didn’t works out :3

img

try to add awk to a env variable and access awk via that :

SansAlpha$ _1=`/???/???`
 
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
 
E: Invalid operation /bin/awk

so /???/??? is malfunctioning because it run /bin/apt too.

------- (after 1 hour)--------

so yeah, after lot of research, we can do something like this to check if that works,

SansAlpha$ _1=( `/???/??? 2>&1` )
SansAlpha$ ${_1[1]}
apt 2.0.6 (amd64)
Usage: apt [options] command
 
apt is a commandline package manager and provides commands for
searching and managing as well as querying information about packages.
It provides the same functionality as the specialized APT tools,
like apt-get and apt-cache, but enables options more suitable for
interactive use by default.
 
Most used commands:
  list - list packages based on package names
  search - search in package descriptions
  show - show package details
  install - install packages
  reinstall - reinstall packages
  remove - remove packages
  autoremove - Remove automatically all unused packages
  update - update list of available packages
  upgrade - upgrade the system by installing/upgrading packages
  full-upgrade - upgrade the system by removing/installing/upgrading packages
  edit-sources - edit the source information file
  satisfy - satisfy dependency strings
 
See apt(8) for more information about the available commands.
Configuration options and syntax is detailed in apt.conf(5).
Information about how to configure sources can be found in sources.list(5).
Package and version choices can be expressed via apt_preferences(5).
Security details are available in apt-secure(8).
                                        This APT has Super Cow Powers.

img

so yeah it works, let me explain what is _1=(/???/??? 2>&1 ) Understanding 2>&1 in Unix-like Shells

so then i tried to access different elements of the array using the ${_1[]} syntax: and targeted [1] and got the apt so i tried the [17] because thats where the /bin/awk was located, so it worked as expected :

SansAlpha$ _1=( `/???/??? 2>&1` )
SansAlpha$ ${_1[1]}
apt 2.0.6 (amd64)
Usage: apt [options] command
 
apt is a commandline package manager and provides commands for
searching and managing as well as querying information about packages.
It provides the same functionality as the specialized APT tools,
like apt-get and apt-cache, but enables options more suitable for
interactive use by default.
 
Most used commands:
  list - list packages based on package names
  search - search in package descriptions
  show - show package details
  install - install packages
  reinstall - reinstall packages
  remove - remove packages
  autoremove - Remove automatically all unused packages
  update - update list of available packages
  upgrade - upgrade the system by installing/upgrading packages
  full-upgrade - upgrade the system by removing/installing/upgrading packages
  edit-sources - edit the source information file
  satisfy - satisfy dependency strings
 
See apt(8) for more information about the available commands.
Configuration options and syntax is detailed in apt.conf(5).
Information about how to configure sources can be found in sources.list(5).
Package and version choices can be expressed via apt_preferences(5).
Security details are available in apt-secure(8).
                                        This APT has Super Cow Powers.
 
SansAlpha$ ${_121]}
bash: ${_121]}: bad substitution
 
SansAlpha$ ${_2]}
bash: ${_2]}: bad substitution
 
SansAlpha$ ${_1[2]}
bash: does: command not found
 
SansAlpha$ ${_1[16]} '$0' ./*/*
bash: operation: command not found
 
SansAlpha$ ${_1[17]} '$0' ./*/*
return 0 picoCTF{7h15_mu171v3r53_15_m4dn355_********}
Alpha-9, a distinctive layer within the Calastran multiverse, stands as a
sanctuary realm offering individuals a rare opportunity for rebirth and
introspection. Positioned as a serene refuge between the higher and lower
Layers, Alpha-9 serves as a cosmic haven where beings can start anew,
unburdened by the complexities of their past lives. The realm is characterized
by ethereal landscapes and soothing energies that facilitate healing and
self-discovery. Quantum Resonance Wells, unique to Alpha-9, act as conduits for
individuals to reflect on their past experiences from a safe and contemplative
distance. Here, time flows differently, providing a respite for those seeking
solace and renewal. Residents of Alpha-9 find themselves surrounded by an
atmosphere of rejuvenation, encouraging personal growth and the exploration of
untapped potential. While the layer offers a haven for introspection, it is not
without its challenges, as individuals must confront their past and navigate
the delicate equilibrium between redemption and self-acceptance within this
tranquil cosmic retreat.
 
SansAlpha$  Connection to mimas.picoctf.net closed by remote host.
Connection to mimas.picoctf.net closed.

i would rate this as HARD :3 BTWW img

Graph View

Backlinks