where-is-the-file picoCTF 2019 Solution

Description

1. Step 1List all files including hidden ones

   Observation

   The description says the file is 'hidden in the folder.' On Unix, hidden usually means a dotfile, and plain ls skips those. So ls -a is the first thing to try.

   Files whose names begin with a dot are hidden from regular ls. The -a flag (all) forces ls to show them. Spot the dotfile and cat it to read the flag.

   bash

   ls -a

   Copied!

   bash

   cat .cant_see_me

   Copied!

   Expected output

   picoCTF{...}

   What didn't work first

   Tried: Running ls without any flags and looking for the file in the visible output

   Plain ls silently skips any filename starting with a dot, so .cant_see_me never appears. The file was on disk the whole time. Only the -a (or --all) flag turns that filtering off.

   Tried: Running cat cant_see_me (without the leading dot) after spotting it with ls -a

   The leading dot is part of the filename, not a path separator. Drop it and the shell looks for a different file and reports 'No such file or directory'. Type the name exactly: cat .cant_see_me.

   Learn more

   In Unix and Linux, any file or directory whose name begins with a period (.) is considered a hidden file (also called a dotfile). The convention originates from a quirk in early Unix where the ls command checked if the first character of a filename was . and skipped it if so - this was originally to hide the . (current directory) and .. (parent directory) entries, and the behavior was later extended by convention to any dotfile.

   The ls -a flag (or --all) overrides this filtering and shows every file including hidden ones. The related ls -A (capital A) shows all files except the special . and .. entries, which is usually more useful. Combining flags: ls -la shows all files in long format with permissions, ownership, size, and modification time.

   Dotfiles are used extensively in Linux for configuration:

   • ~/.bashrc, ~/.zshrc - shell configuration
   • ~/.ssh/ - SSH keys and known hosts
   • ~/.gitconfig - git user configuration
   • ~/.env - environment variables (sometimes accidentally committed to git)
   • .htaccess - Apache web server configuration per-directory

   In security contexts, attackers often hide malicious files with dotnames to avoid casual detection. During incident response, checking for unexpected dotfiles in home directories, /tmp, and web server directories is an important step. Tools like find / -name ".*" -type f enumerate all dotfiles system-wide. The lesson: "hidden" files in Unix are only hidden from casual ls use - they are perfectly visible with the right flags.

Flag

Per-instance flag. The prefix picoCTF{w3ll_that_d1dnt_w0RK_ is the same on every instance; the 8-character hex suffix that follows it is generated per instance, so read yours off your own box rather than reusing one from anywhere else.