miscmedium

HashCashSlash

0xl4ugh

Task: Bash jail with only 3 allowed characters (#, $, \). Flag is root-only. Solution: Escape jail with \$$# payload, enumerate /proc to find hidden socat service on localhost that serves the flag.

$ ls tags/ techniques/
bash_jail_escapeproc_cmdline_enumlocalhost_service_discovery

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]