miscPromedium
HashCashSlash
0xl4ugh
Task: Bash jail with only 3 allowed characters (#, $, \). Flag is root-only. Solution: Escape jail with \$$# payload, enumerate /proc to find hidden socat service on localhost that serves the flag.
$ ls tags/ techniques/
bash_jail_escapeproc_cmdline_enumlocalhost_service_discovery
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [misc][free]Broken Shell— hackthebox
- [misc][free]bctf-infra— b01lersc
- [misc][free]rustjail— b01lersc
- [pwn][Pro]Cmd— spbctf
- [pwn][Pro]cat /flag under seccomp— spbctf