Utterly Broken Shell

hackthebox

Task: restricted bash shell (jail) where input is regex-checked against ^[${}![:space:]:_=()]+$ before eval — no letters, numbers, slashes, quotes, or globs allowed. Solution: generate numbers via arithmetic expansion $(()) and $((!$(())) ), access $0 path via indirect expansion ${!var}, extract individual characters via parameter expansion ${var:offset:length}, build commands (cd, ls, nl) from underscore-only variables to navigate filesystem and read the flag.