Description
The Multiverse is within your grasp! Unfortunately, the server that contains the secrets of the multiverse is in a universe where keyboards only have numbers and (most) symbols.
Setup
Keyboard-restricted shellSSH to mimas.picoctf.net on port <PORT_FROM_INSTANCE> with password <PASSWORD_FROM_INSTANCE>.
Remember that pressing Enter on an invalid command prints helpful error messages containing letters you can reuse.
Solution
- Step 1Initialize variable with error message
Run _1=`$ 2>&1` to capture the error "bash: $: command not found". Verify by running `"$_1"` which outputs: "bash: bash: $: command not found: command not found"
_1=`$ 2>&1` - Step 2Extract characters from error message
The error message contains many useful letters. Use bash parameter expansion to slice out specific characters:
- Step 3Locate the flag file
Run ./*/* to discover the flag is at ./blargh/flag.txt. The filename pattern is ./*/????.???
./*/*
Character Extraction Chart
From the error message "bash: bash: $: command not found: command not found", extract these characters:
| Expression | Character |
|---|---|
| ${_1:9:1} | c |
| ${_1:1:1} | a |
| ${_1:19:1} | t |
| ${_1:2:1} | s |
| ${_1:10:1} | o |
Note: Initially attempted /?${_1:2:1}?/???/??${_1:19:1} to reach /usr/bin/cat, but this showed an invalid operation. The working solution uses /bin/echo instead.
Solution (continued)
- Step 4Build the echo command
Construct /bin/echo using /???/?${_1:9:1}?${_1:10:1} where ${_1:9:1} gives "c" and ${_1:10:1} gives "o". This can be tested locally first to verify it works.
/???/?${_1:9:1}?${_1:10:1} - Step 5Read the flag
Use the echo command with bash process substitution to read the file: /???/?${_1:9:1}?${_1:10:1} "$(<./*/????.???)" This outputs "return 0" followed by the flag.
/???/?${_1:9:1}?${_1:10:1} "$(<./*/????.???)"
Flag
picoCTF{7h15_mu171v3r53_15_m4dn355_145...}
This challenge can be solved in many different ways through trial and error. The key insight from the hint "Where can you get some letters?" is to harvest characters from error messages and use bash parameter expansion to build valid commands.