Special

Author: LT 'syreal' Jones | 300 points

Description

Don't power users get tired of making spelling mistakes in the shell? Not anymore! Enter Special, the Spell Checked Interface for Affecting Linux. Now, every word is properly spelled and capitalized... automatically and behind-the-scenes! Be the first to test Special in beta, and feel free to tell us all about how Special streamlines every development process that you face. When your co-workers see your amazing shell interface, just tell them: That's Special (TM) Start your instance to see connection details.

ssh -p ***** [e-mail]

The password is ********

Solution

First we use the ssh command above to login to the challenge environment and are greeting with the 'Special' shell. It appears the shell takes our commands and tries to spell check them into actual words like 'is' and 'pod'. Below I try to use ls and it spell checks it to is.

Special$ ls
Is 
sh: 1: Is: not found

Additionally, when we try to use the bash command to spawn a bash shell, we are greeted with the following prompt.

Special$ bash
Why go back to an inferior shell?

I've always been more of a zsh guy anyway. After messing around with the syntax of the commands for a bit, we find out if we use double parentheses we can get commands to execute. Using this method with ls, we find a file in the home directory.

Special$ ((ls))
((ls)) 
blargh
Special$

With enough parentheses.. we find out blargh is a directory.

Special$ (((((((cat blargh)))))))
(((((((cat blargh))))))) 
cat: blargh: Is a directory

Now we just ls the directory, see there is a flag.txt file, and cat the file to get the flag.

Special$ ((((ls blargh))))
((((ls blargh)))) 
flag.txt
Special$ ((((cat blargh/flag.txt))))
((((cat blargh/flag.txt)))) 
picoCTF{5p311ch3ck_15_7h3_w0r57_6a2763f6}

Flag

This was kind of a silly challenge but nonetheless the flag is picoCTF{5p311ch3ck_15_7h3_w0r57_6a2763f6}