$ cat writeup.md…
$ cat writeup.md…
kalmarctf
Task: source and VM exposed a web panel that accepted arbitrary Nix expressions and a root rebuild helper using VERSION_SUFFIX. Solution: poison the pinned Nix source fixed-output derivation with Linux fd smuggling, then let root rebuild Nix from the corrupted store path and leak the copied flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar