$ cat writeup.md…
$ cat writeup.md…
0xl4ugh
Task: Bash jail with only 3 allowed characters (#, $, \). Flag is root-only. Solution: Escape jail with \$$# payload, enumerate /proc to find hidden socat service on localhost that serves the flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar