picoCTF WriteUp | ping-cmd

Introduction

#

Hey everyone 👋 — In this Capture The Flag (CTF), we are given a task to make a server “reveal” its secrets.

Analyzing The Server

#

It uses the ping command to get a response from a server. However, it could be exploited by running other commands.

8.8.8.8 && echo hi

Exploit

#

We could use this as our advantage to list all files in the server.

8.8.8.8 && ls

We could see 2 files listed which is flag.txt and script.sh. Lets get the flag!

8.8.8.8 && cat flag.txt

Bingo! 🥳 This exposed the flag.

Flag 🚩

#

picoCTF{p1nG_c0mm@nd_3xpL0it_su33essFuL_8555bda7}