## sigknock WPICTF 2020 Writeup
This was the challenge text:
```sigknock - 200 (Linux)
Port knocking is boring. Enhance your security through obscurity using sigknock.
ssh [email protected]
pass: $1gkn0ck
made by: acurless
Note: this challenge is in no way related to the open source tool of the same name.
```
When you SSH in, you're dropped in an alpine docker container.
```$ ssh [email protected]
~ $ cat /etc/os-release NAME="Alpine Linux"ID=alpineVERSION_ID=3.11.5PRETTY_NAME="Alpine Linux v3.11"HOME_URL="https://alpinelinux.org/"BUG_REPORT_URL="https://bugs.alpinelinux.org/"
~ $ ls -lah .total 16K    drwxr-sr-x    1 wpictf   nogroup     4.0K Apr 19 19:53 .drwxr-xr-x    1 root     root        4.0K Apr 14 05:16 ..-rw-------    1 wpictf   nogroup       31 Apr 19 19:53 .ash_history
~ $ iduid=1010(wpictf) gid=65533(nogroup) groups=65533(nogroup)
~ $ ps auxPID   USER     TIME  COMMAND    1 wpictf    0:00 {init_d} /bin/sh /bin/init_d    7 wpictf    0:00 /usr/bin/irqknock    8 wpictf    0:00 /bin/sh   12 wpictf    0:00 ps aux```
There's an interesting process running `/usr/bin/irqknock`...
This must be a hint to do some interrupt requests (IRQ) against the process.
I quickly discovered that sending SIGINT increased the program "state":```~ $ kill -2 $pidGot signal 2State advanced to 1```
I made this little hack to get the pid for irqknock which came in handy:```~ $ pid=$(ps aux | grep irq | grep -v grep | tr -s ' ' | cut -d ' ' -f 2)~ $ echo $pid7```
Through some trial and error I discovered the correct "IRQ knock sequence":```~ $ kill -2 $pidGot signal 2State advanced to 1
~ $ kill -3 $pidGot signal 3State advanced to 2
~ $ kill -11 $pidGot signal 11State advanced to 3
~ $ kill -13 $pidGot signal 13State advanced to 4
~ $ kill -17 $pidGot signal 17State advanced to 5WPI{1RQM@St3R}```
There's the flag `WPI{1RQM@St3R}` :D