Uglybash was in the Misc *category*, which means these task are for the lazy people and doesnt require much programming skills.
In the challenge we get a cmd.sh file, which is a bash script file with the contents:```${*%c-dFqjfo}  e$'\u0076'al "$(   ${*%%Q+n\{}   "${@~}" $'\160'r""$'\151'$@nt"f" %s   ' }~~@{$  ")   }La?cc87J##@{$   ;   }  ;  }8CC3vD/qX$t/*{$   }~~*{$   "}] "}^@{$"  y4R2SV$   "}cIqe[\(\%@{$" "}xk:W=Y2##@{$" [JzbY6E{$"   s%   ft'"'"'n'"'"''"'"'i'"'"'r\p  { ; }*!{$ ]  )e#22+)2}8Kr6>#*{$#82*01#3}^*{$((   [$ "};(\S-[\/@{$"   "},@{$"   ]  )71}|$1+d/$_dj/*{$#8+)2#16*1"}xp.{\$Z~[\%@{$"#}~*{$7"1"-((  [$ "@$"  "}oMAHn%%@{$"   ))  )0"1"01"}^@{$"#4}]\oh>-%%@{$+)"a"1#21"-"+l#"1""5"-})\+{\$rMTE%%@{$((   (($ }Omm"\V#*{$   }8z<TPr/*{$   ]   ))11"#"2+)"2""#""7""5"-"}qJ)\)\!\{\#/Ije>VU//@{$"-2}_axM-*/*{$#"7""3"(-(-( [$ }f9~U//*{$  }#Jgkvc#@{$   ))  )1#}7e[\Trh{\//@{$4+)0#62*0#}*{$"9"(( (($ }S(\{\0)\##@{$   ] )21"}jAVg1-%%@{$""#"5+)"1"1#}*{$4}*{$-*"0"1#"}~~@{$""3"-((   [$   }^^*{$   ]   )11#}*!{$"3"+)1*$#93*2#"6"5"@$"((   [$  }0c;x]\^Y//*{$  })\mei/b6B1atD)\//*{$  ]  )1"1"0001#2"}fhF`\x/s77vTa[\/@{$"+)0*$#}R"\>(\/RTS8//*{$"6"+l"#"03-((  [$ }^^@{$ ))   ))31"#"5+)11#7--00"}&*]\7//@{$"1#2}`\g]\<Roj/}\~(\<Qq/*{$(-(-(  (($  }~@{$  ))   )"1""#"5}mR&<7r/}\dC!\s*k/*{$3+)i#65-6"1"#}NojyN70T##*{$92}@!{$((  (($  },,*{$ ]  )i}Ym5{\y##@{$#}!\a.8/*{$"0"2},,*{$+)01#4+"b"#94}*{$-((  [$   }@{$   }~*{$ )) )52#8+)0#62*0#05(( (($  })\C62X/*{$  }mibf/*{$ )) )"4"2"#"6}~f`\^/@{$1}3NKi^FgW/*{$+)2}="\ulQ;/*{$"#"7}@!{$3-+k#35-((   (($  }*{$ }*{$  ] )i#16+)01#3*11#2}?L7X>/~^MeZH/@{$-((   [$  *$  }@{$   ))  )222#3+)11},,@{$#"2"*1"1"#4-((   (($   "}@{$" }*!{$ ]   )d#53}e~+uz61###@{$+)0}~~*{$01#2--2"1""#"3((   [$ }~~*{$   ))   )j"}^^@{$"#"},@{$"0}~*{$3+)11#4-}ml;.##@{$+"1"#8}"\r"\>cohJ/*{$4(( (($   }*!{$   )) )"a"1"#""1"5+)03#7-e}^^*{$#12-((  (($ "}~@{$"  ))  ))22"1"#3+)2#"}Y9cefj9%%@{$"41-*$-"y"#84(-(-(   (($   }^^@{$   ))   )011}~~@{$1},,*{$#2+)"1"#52*11#3-}^^*{$(( (($  }*{$ ]   ))0#"1"1+)0#04*0"#"2"},,@{$"1}*!{$(-(-( [$   }~~@{$ ))   )43#2"}gC@u/@{$"1+)"1"1}pQCP//*{$#2-}^@{$*01#*$8(( (($ }dlz"\T%%*{$  },h]\rj`\}\/RPQto"\/*{$   )) ))1#2}Vf}\]\Nu##@{$1+)11"#"2--0})\HIZ/*{$#05(-(-(  (($   },,*{$ }~~@{$ ))  )"a"#"6"3"}TIP]\@V##@{$"+)2}`\.\%Qxt/?:4,/@{$#02-*01#3-}{\Di6HUx@%@{$((  (($ "}~@{$" }34v@##*{$   ]  ))11#"5"+)h"}BdoI#@{$"1#1}t*f+fWlA//*{$2+2}~~*{$"1"#},,*{$5-(-(-(   [$   };y$!\M8##@{$  ))   )1#"7""1"+)0*$"#""1"3*0#5}*{$1"}Rw6a//@{$"(( (($   }Q-Vf9d%%*{$  ))   )1},,*{$#15+)0}+lDQf%@{$#"2"*0#74((  (($   }_%$KT9f/iTW~$_/*{$  @$  ]   )"m"#3},@{$"3"+)1"1"#2-*0#"5"1(( [$  "},@{$"   }TX`\`\%%@{$ ] )"1"1#5"}FE=UU=W./&<"\8l7/@{$"+)0#3*01#3-((   [$ }*{$   }aO;R"\w/9jJF1//*{$   ]   )"2"1#"}9uT]\j1f;##@{$""6"+)j#"7"4-"}^^@{$"-b#14-((   [$   }^^*{$ }~~*{$ )) ))1"#"34+)"0"1#}exP"\/TG!\)\T!\?//@{$6+1}*!{$#0}<7V&/*{$6-(-(-(   (($ }Mi@S<]\Q#*{$ }^^*{$   ]   )2}}\2jz]\G49/#dn>8/*{$2#"}<FTeK&n,//@{$"3"},,@{$"+)1#3-+00}I3cO.O;Z%%@{$"1"#"2"-},*{$(( [$ }B;h_1VnC%%*{$   "}@{$"  ]  )01}*{$#3+)1#*$8"3"--02#4((  [$  }.\np,/?{\~b03//*{$  "},@{$" ))  ))02#4+)"n"#}SPKP8tw##@{$45--1"#"03(-(-(  (($  "}@{$"   ]   ))n"#"14+)s#44+2}@{$2#}~*{$8}7Qq~iq%%*{$(-(-(   [$   *$   ]   )21"#"4+)n"}~@{$"#}\\@<f$4/*{$45--"1"2"#"3-(( [$  }@{$ }*{$ ))   )41#"3"1+)0"#"15*11#"6"(( (($   },,@{$ ]   )d#}t_=_//*{$8}ha5]\78/*{$"1"+)01#3"-"*1"}G2T~wh2##@{$""#"64-(( [$  }^^@{$   }.T9P_8Gv//*{$ ]   )2"#"73"}$oE?##@{$"+)1},,*{$"1"#}K.o%o$t/uR@fekB#/@{$2-"0""1"#}@bCU%*{$4((  [$  "}3nB?u8fG//@{$" ))  )"3""2""#"11"@$"+)0"}~@{$"1#4-+a#5"4"-((  (($ }~y?mRx/BM"\H]\//*{$  "}4^4rR/@{$" ]   )"G"#74}~@{$+)2#52}@!{$"-"*a#7"1"((  [$  }@!{$ }~~*{$   ]  ))1#84+)31#5+h#03(-(-(  [$   }&+?82EU%%*{$   }@!{$   ]   )l"#""3"2+)1}~*{$#21*0"}4[\P!\/|Ec{\e/@{$"1}*{$"#"5-((  [$ }:p-c^h+/:r#lsa//*{$ }*{$ ))  )00}@!{$1#}BFcS!\%@{$2+)1#"0"6*1#}~~*{$71-(( (($  }~~*{$ }"\&`\QS*%*{$   ]   )z"#"44+)11"#""5"-*2#4"2"((   [$   "}^^@{$" }RU*x9!\22/ySk%Ir/@{$ ))  )e"#"0"5"+)2#7"2"*"1"1#2"-"(( (($  }*{$ }LNt)\,//@{$ ))   ))0#}}\TMHUEV//*{$0}{\^WK!\##*{$6+)11#6-}ahZD^2~/:C,Io\C/*{$-"1"#65-"}H@zpzY8%@{$"(-(-(   (($  "}QrL2J\~%%@{$"  "}n(\7?)\)\J%%@{$"  ]   )0"1""#"11+)0#"8"2-11}*{$"#"4((  [$   }(\L-.D:/.41yxK]\//*{$  ]   ))21"#"7+)2#24--"f""#"32(-(-(  [$ },*{$ }@!{$ ] )22#81}^*{$+)1"1"#4}~*{$"-"*001#}*{$2(( [$ }^^@{$   },,@{$   ] )j},,*{$#"}u7=$6]\/o43H//@{$"2"5"+)1"1""1""#"2-101#2-((  [$  }$Wil##@{$  }l=:G>(\-#@{$  ] ))0#75}~~@{$+)1"#""9"+1"}JZ2I7=&/@{$""1"#}~~*{$3(-(-(  [$  ni  y4R2SV  rof &&   },,@{$  )  }^*{$  g  }^^*{$ y   }g$U-b9%@{$   j   }*!{$   n }~@{$  *$  u   "}(\whfI/@{$"  "}@{$"  z  }RH|<=z##@{$   }~~@{$  '"'"'ax\'"'"'$   }^^@{$  a }~*{$ }dS^Db6G}\%*{$   h   }@{$   }^*{$ r  "}m&Jk:b?/WBG02h}\_/@{$"  \ }T|qd//*{$  }OM`\6.o%@{$   {\  }H%ynnO(\u//*{$   }g8Gv|R~/*{$  _\  }-:zfUz%%*{$ }\   })\#?1{\OK/@{$ *$  i  }__b5W:RE//@{$  s   }%<Oy{\I//*{$ }"\-iPfz]\g/ug|0w8/*{$   l }L#vh$/{\wLz8/@{$ }60-tI0<%%*{$ 3  "}^@{$" o }euc*##@{$   c  }~~*{$  }~~*{$  d }_h)\)\{\/i$V2/@{$   e   *$   }(\&`\C?*3%%@{$   ,\ "}@{$" }~@{$  t   "},@{$"   }^^*{$ #\  }*^RXtV##*{$   m  "}@{$"   f "},@{$"   (=JzbY6E     ($"  <<< },,*{$   }C0#Y%%*{$  HSAB$ "}|=1SW.//@{$"   "@$" '  ${*,} ${@/;mO4/qc~&y} |  ${@/a\{oy_BGF/*:wJ}   ${@##~@pBeI}   "r"""ev   ${*~}  ${*%K^vf&^3<}  ;  ${*#SBvLg=k\[}  ${*^}    )"   ${!@} > file```
Which looks like a lot of obfuscation.On running, it prints out the string:```dont just run it, dummy```
From this, we can assume two things:1. There is a carriage symbol '\r' which prints the flag and then overwrites it.2. The flag is commented out inside the script
But how can we solve it.A little research tells us that it uses [Bashfuscator](https://github.com/Bashfuscator/Bashfuscator)
I tried to find a deobfuscator for this but didnt found any, so lets take our first assumption that it uses a carriage symbol and overwrites out the flag.
We can use this command to set a breakpoint after every instruction and sleeps for 5 seconds```trap "set +x; sleep 5; set -x" DEBUG```
And then run our script and save it to a file to check its contents```./cmd.sh > output```
On analyzing the file, there are a lot of printf so we can filter through it.```type output | findstr -i printf```
Which gives us the output```+++ printf %s e+++ printf %s c+++ printf %s h+++ printf %s o+++ printf %s ' '+++ printf %s d+++ printf %s o+++ printf %s n+++ printf %s t+++ printf %s ' '+++ printf %s j+++ printf %s u+++ printf %s s+++ printf %s t+++ printf %s ' '+++ printf %s r+++ printf %s u+++ printf %s n+++ printf %s ' '+++ printf %s i+++ printf %s t+++ printf %s ,+++ printf %s ' '+++ printf %s d+++ printf %s u+++ printf %s m+++ printf %s m+++ printf %s y+++ printf %s ' '+++ printf %s #+++ printf %s ' '+++ printf %s f+++ printf %s l+++ printf %s a+++ printf %s g+++ printf %s {+++ printf %s u+++ printf %s s+++ printf %s 3+++ printf %s _+++ printf %s z+++ printf %s s+++ printf %s h+++ printf %s ,+++ printf %s _+++ printf %s d+++ printf %s u+++ printf %s m+++ printf %s m+++ printf %s y+++ printf %s }```And it gives out the flag```flag{us3_zsh,_dummy}```
Also available on my [Github](https://github.com/DaBaddest/CTF-Writeups/tree/master/RedPwn2020/uglybash)