Specialer

Author: LT 'syreal' Jones, et al. | 400 points

Description

Reception of Special has been cool to say the least. That's why we made an exclusive version of Special, called Secure Comprehensive Interface for Affecting Linux Empirically Rad, or just 'Specialer'. With Specialer, we really tried to remove the distractions from using a shell. Yes, we took out spell checker because of everybody's complaining. But we think you will be excited about our new, reduced feature set for keeping you focused on what needs it the most.

Please start an instance to test your very own copy of Specialer.

Solution

Once we log in, we can tell the shell has been 'reduced' by it's lack of commands such as ls and cat. However, we can access commands such as cd and pwd.

Also, the nice thing about actual good shells is the features.. such as autocomplete. Without realizing it, I hit Tab->Tab after typing cd and got a list of directories. Who needs ls?

Specialer$ cd 
.hushlogin  .profile    abra/       ala/        sim/        
Specialer$ cd 

You can also hit Tab->Tab on a blank line and get a list of all the commands!

Specialer$ 
!          bind       compopt    elif       fc         if         printf     shift      true       while
./         break      continue   else       fg         in         pushd      shopt      type       {
:          builtin    coproc     enable     fi         jobs       pwd        source     typeset    }
[          caller     declare    esac       for        kill       read       suspend    ulimit     
[[         case       dirs       eval       function   let        readarray  test       umask      
]]         cd         disown     exec       getopts    local      readonly   then       unalias    
alias      command    do         exit       hash       logout     return     time       unset      
bash       compgen    done       export     help       mapfile    select     times      until      
bg         complete   echo       false      history    popd       set        trap       wait       
Specialer$ 

Now we just figure out how to view the files without using cat.

After doing some research on the echo command, I found out you can use it to print the contents of files. So I printed one of the files!

Specialer$ echo "$(<kazam.txt)"
return 0 picoCTF{y0u_d0n7_4ppr3c1473_wh47_w3r3_d01ng_h3r3_38f5cc78}
Specialer$ 

I got kinda lucky and picked the right file, "kazam.txt" in the "ala" directory, the first try, since there are other files and directories in effort to hide the flag.

Flag

The flag is picoCTF{y0u_d0n7_4ppr3c1473_wh47_w3r3_d01ng_h3r3_38f5cc78}