Description
The "useless" workstation exposes SSH access plus a suspicious calculator script. Somewhere inside its documentation hides the flag.
Setup
SSH into saturn.picoctf.net on the port your instance was assigned, using the credentials the challenge page gives you.
List the home directory, execute ./useless, and read both the script and its man page.
ssh picoplayer@saturn.picoctf.net -p <PORT_FROM_INSTANCE># then paste the password from the challenge page at the promptls && ./uselessman uselessSolution
Want to try it yourself first?
The guided walkthrough reveals hints one step at a time.
Step 1Inspect the script
ObservationRunning ./useless with no arguments prints 'Read the code first.' The script is not hiding anything, so read it before trying anything else.Running the script without proper arguments prompts you to "Read the code first." View the bash source to learn it performs basic math operations.bashless uselessWhat didn't work first
Tried: Running ./useless with math arguments like ./useless 2 + 3 to trigger hidden behavior or expose the flag.
The script just prints a numeric result and exits normally. No hidden flag branch exists inside the arithmetic logic. The flag is not reachable through any combination of arguments; it lives in the man page documentation, not in the script's runtime output.
Tried: Using strings useless to look for the flag embedded in the script binary.
useless is a bash script, not a compiled binary, so strings just prints the whole file back at you. Nothing is hidden inside it; the flag was deliberately put in a separate man page. Reading the source shows the math and nothing else.
Learn more
Shell scripts are plain-text files containing sequences of shell commands. Unlike compiled binaries, their source code is always readable with
lessor any text editor; there is no compilation step to reverse. This transparency is both a feature (easy to audit) and a limitation (no obfuscation possible without an external binary).Bash scripts often use a shebang line at the top (
#!/bin/bash) to specify the interpreter. The script's error message telling you to "Read the code first" is a metacommentary; the challenge is literally teaching you that reading source code is the right debugging approach. In CTF terms, source code review (white-box testing) is always preferable to black-box guessing when the source is available. For broader Linux command-line workflow tips, see Linux CLI for CTF.Step 2Read the manual
ObservationThe source is just arithmetic, with no hidden flag branch, and the setup already points at 'man useless'. The flag is in the custom man page, not the script.Find the actual man page path with man -w useless, then run man useless and jump to the bottom. The flag is stashed at the end of the page.bashman -w uselessbashman uselessExpected output
/usr/local/share/man/man1/useless.1.gz
What didn't work first
Tried: Grepping the raw script file for picoCTF with grep picoCTF useless instead of reading the man page.
The flag lives in the gzipped man page at /usr/local/share/man/man1/useless.1.gz, so grepping the script matches nothing. Run man useless and scroll to the end, or pipe the decompressed page through grep.
Tried: Scrolling through the man page with the arrow keys from the top instead of jumping directly to the end.
Man pages open in less, which paginates. Arrowing down through several pages is slow and a single flag line is easy to skim past. G jumps straight to the end where the flag sits, and /picoCTF searches for it directly.
Learn more
man pages are the traditional documentation system for Unix/Linux programs. Every standard command has a man page accessible via
man <command>. Man pages are written in troff/groff markup and displayed through a pager (usuallyless). They are organized into sections: 1 (user commands), 2 (system calls), 3 (library functions), 5 (file formats), 8 (system administration), and so on.man -w uselessprints the actual filesystem path of the man page (often something like/usr/local/share/man/man1/useless.1.gz). Knowing the path lets you grep the raw troff source directly withzcat $(man -w useless) | grep picoCTFif you would rather not scroll.Custom programs can install their own man pages in
/usr/local/share/man/or/usr/share/man/. This challenge placed a man page for theuselessscript there, mimicking how real software is documented. The flag hidden at the bottom of the man page teaches you to always read documentation thoroughly; important context, warnings, or in this case flags, are often at the end.Navigating man pages. Man pages open in
lessby default. Key navigation:Spaceorf: scroll forward one pageb: scroll backward one pageG: jump to the end (where the flag is)g: jump to the beginning/pattern: search for a pattern (e.g./picoCTF)q: quit
Real-world significance. Hiding data inside documentation is obfuscation, not real steganography; anyone reading the docs end-to-end will see it. In real penetration testing, reading all available documentation, comments, and metadata of a target system is called information gathering or reconnaissance; you never know what useful details (API keys, internal URLs, debug flags) might be left in plain sight inside docs and comments.
Interactive tools
- Regex TesterTest regular expressions against a string with live match highlighting, flag toggles, and common CTF pattern shortcuts.
- Strings ExtractorPull printable text from any binary, library, or image. ASCII and UTF-16 detection, configurable minimum length, flag-like highlight, no command line needed.
- Reverse Shell GeneratorGenerate reverse shell payloads (bash, nc, python, perl, ruby, php, node, powershell) and matching listeners. Set host and port once, copy any variant.
Flag
Reveal flag
picoCTF{us3l3s...it3d_4373}
No exploitation is required; just follow the hints inside the tool's documentation.