Challenge: Work ComputerCategory: sandbox
Description:
With the confidence of conviction and decision making skills that made you a contender for Xenon's Universal takeover council, now disbanded, you forge ahead to the work computer.This machine announces itself to you, surprisingly with a detailed description of all its hardware and peripherals.Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"You always were one for the trivialities of things.Also presented is an image of a fascinating round and bumpy creature, labeled "Cauliflower for cWo" - are "Cauliflowers" earthlings?Your 40 hearts skip a beat - these are not the strange unrelatable bipeds you imagined earthings to be.. this looks like your neighbors back home. Such curdley lobes. Will it be at the party?SarahH, who appears to be  a programmer with several clients, has left open a terminal.  Oops.  Sorry clients!  Aliens will be poking around attempting to access your networks.. looking for Cauliflower.   That is, *if* they can learn to navigate such things.
readme.ctfcompetition.com 1337
SolutionWere greeted with a shell so im guessing its time to escape.
> helpAlien's shellType program names and arguments, and hit enter.The following are built in:  cd  help  exitUse the man command for information on other programs.
Checking for basic commands we have access to and what directories we can listThis one isnt a writeup as much as testing what different utilities do and seeing what I can make sense of.READ THROUGH THE ENTIRE THING TO SEE THE PROCESS I TOOK!!!
> cd  aliensh: expected argument to "cd"> cd ./> lsORME.flagREADME.flag> echo README.flagREADME.flag> echo ./README.flag./README.flag> caterror: No such file or directory> echo ./*./*> ls  ORME.flagREADME.flag> ls O	ls: O: No such file or directory> ls ORME.flagORME.flag> file ORME.flagerror: No such file or directory> file error: No such file or directory> lesserror: No such file or directory> moreerror: No such file or directory> vimerror: No such file or directory> vierror: No such file or directory> echo ./*./*
> cd ../bin> lsarchbusyboxchgrpchownconspydatedfdmesgdnsdomainnamedumpkmapechofalsefdflushfsyncgetopthostnameioniceiostatipcalckillloginlslzopmakemimemkdirmknodmktempmountmountpointmpstatnetstatnicepidofpingping6pipe_progressprintenvpspwdreformimermrmdirrun-partssetprivsetserialshellsleepstatsttysynctartrueumountunameusleepwatch> ls -a...archbusyboxchgrpchownconspydatedfdmesgdnsdomainnamedumpkmapechofalsefdflushfsyncgetopthostnameioniceiostatipcalckilllogin> cd . > cd ..> lsbinchallengedevetchomelibmediamntoptprocrootrunsbinsrvsystmpusrvar> cd bin> lsarchbusyboxchgrpchownconspydatedfdmesgdnsdomainnamedumpkmapechofalsefdflushfsyncgetopthostnameioniceiostatipcalckillloginlslzopmakemimemkdirmknodmktempmountmountpointmpstatnetstatnicepidofpingping6pipe_progressprintenvpspwdreformimermrmdirrun-partssetprivsetserialshellsleepstatsttysynctartrueumountunameusleepwatch> printenvSHLVL=1PWD=/challenge> $error: No such file or directory> dumpkmapdumpkmap: can't open console> nice19> dfFilesystem           1K-blocks      Used Available Use% Mounted on/dev/sda1             20145724   7303332  12826008  36% /none                      4096         0      4096   0% /tmpnone                      4096         0      4096   0% /devnone                      4096         0      4096   0% /dev/shmnone                      4096         8      4088   0% /challenge> man dferror: No such file or directory> df -hFilesystem                Size      Used Available Use% Mounted on/dev/sda1                19.2G      7.0G     12.2G  36% /none                      4.0M         0      4.0M   0% /tmpnone                      4.0M         0      4.0M   0% /devnone                      4.0M         0      4.0M   0% /dev/shmnone                      4.0M      8.0K      4.0M   0% /challenge > ttynot a tty> printfBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: printf FORMAT [ARG]...
Format and print ARG(s) according to FORMAT (a-la C printf)> printf /challenge/*/challenge/*> > > conspyconspy: can't open '/dev/vcsa': No such file or directory> cd ..
> busyboxbusybox can not be called for alien reasons.> sudoerror: No such file or directory> mpstatLinux 4.15.0-1023-gcp (jail-0)	07/14/19	_x86_64_	(2 CPU)
18:27:47     CPU    %usr   %nice    %sys %iowait    %irq   %soft  %steal  %guest   %idle18:27:47     all    0.67    0.02    0.50    0.02    0.00    0.01    0.00    0.00   98.79> netstatActive Internet connections (w/o servers)Proto Recv-Q Send-Q Local Address           Foreign Address         State       Active UNIX domain sockets (w/o servers)Proto RefCnt Flags       Type       State         I-Node Path> lsORME.flagREADME.flag> cd ..> lsbinchallengedevetchomelibmediamntoptprocrootrunsbinsrvsystmpusrvar> ls rootls: can't open 'root': Permission denied> ls run> ls run/*ls: run/*: No such file or directory> ls tmp> ls devshm> ls etcTZalpine-releaseapkca-certificatesca-certificates.confconf.dcrontabsfstabgrouphostnamehostsinit.dinittabinputrcissuelogrotate.dmodprobe.dmodulesmodules-load.dmotdmtabnetworkoptos-releasepasswdperiodicprofileprofile.dprotocolssecurettyservicesshadowshellssslsysctl.confsysctl.dterminfoudhcpd.conf> ls -al etctotal 196drwxr-xr-x   17 65534    65534         4096 Jun 13 14:28 .drwxr-xr-x   20 0        0             4096 Jun 13 14:28 ..-rw-r--r--    1 65534    65534            4 Jan 23 20:46 TZ-rw-r--r--    1 65534    65534            6 May  9 20:49 alpine-releasedrwxr-xr-x    4 65534    65534         4096 Jun 13 14:28 apkdrwxr-xr-x    3 65534    65534         4096 Jun 13 12:48 ca-certificates-rw-r--r--    1 65534    65534         6285 Jan 29 16:27 ca-certificates.confdrwxr-xr-x    2 65534    65534         4096 May  9 20:49 conf.ddrwxr-xr-x    2 65534    65534         4096 May  9 20:49 crontabs-rw-r--r--    1 65534    65534           89 Jan 23 20:46 fstab-rw-r-----    1 65534    65534          726 Jun 12 13:57 group-rw-r--r--    1 65534    65534           10 Jan 23 20:46 hostname-rw-r--r--    1 65534    65534           79 Jan 23 20:46 hostsdrwxr-xr-x    2 65534    65534         4096 May  9 20:49 init.d-rw-r--r--    1 65534    65534          570 Jan 23 20:46 inittab-rw-r--r--    1 65534    65534         1748 Nov 15  2018 inputrc-rw-r--r--    1 65534    65534           53 May  9 20:49 issuedrwxr-xr-x    2 65534    65534         4096 May  9 20:49 logrotate.ddrwxr-xr-x    2 65534    65534         4096 May  9 20:49 modprobe.d-rw-r--r--    1 65534    65534           15 Jan 23 20:46 modulesdrwxr-xr-x    2 65534    65534         4096 May  9 20:49 modules-load.d-rw-r--r--    1 65534    65534          283 Jan 23 20:46 motdlrwxrwxrwx    1 65534    65534           12 May  9 20:49 mtab -> /proc/mountsdrwxr-xr-x    8 65534    65534         4096 May  9 20:49 networkdrwxr-xr-x    2 65534    65534         4096 May  9 20:49 opt-rw-r--r--    1 65534    65534          162 May  9 20:49 os-release-rw-r-----    1 65534    65534         1289 Jun 12 13:57 passwddrwxr-xr-x    7 65534    65534         4096 May  9 20:49 periodic-rw-r--r--    1 65534    65534          259 Jan 23 20:46 profiledrwxr-xr-x    2 65534    65534         4096 May  9 20:49 profile.d-rw-r--r--    1 65534    65534         1865 Jan 23 20:46 protocols-rw-r--r--    1 65534    65534           65 Jan 24 07:45 securetty-rw-r--r--    1 65534    65534        36141 Jan 23 20:46 services-rw-r-----    1 65534    65534          441 May  9 20:49 shadow-rw-r--r--    1 65534    65534           38 Jan 23 20:46 shellsdrwxr-xr-x    5 65534    65534         4096 May  9 20:49 ssl-rw-r--r--    1 65534    65534           53 Jan 23 20:46 sysctl.confdrwxr-xr-x    2 65534    65534         4096 May  9 20:49 sysctl.ddrwxr-xr-x    9 65534    65534         4096 Jun 13 12:48 terminfo-rw-r--r--    1 65534    65534         4169 Jan 24 07:45 udhcpd.conf> ./error: Permission denied> cd challenge> ./README.flagerror: Permission denied> ./ORME.flagerror: Permission denied> ls -lttotal 8----------    1 1338     1338            33 Jul 14 18:23 ORME.flag-r--------    1 1338     1338            28 Jul 14 18:23 README.flag> whoamiwhoami: unknown uid 1338> whoerror: No such file or directory> chownBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: chown [-RhLHPcvf]... USER[:[GRP]] FILE...
Change the owner and/or group of each FILE to USER and/or GRP
	-R	Recurse	-h	Affect symlinks instead of symlink targets	-L	Traverse all symlinks to directories	-H	Traverse symlinks on command line only	-P	Don't traverse symlinks (default)	-c	List changed files	-v	List all files	-f	Hide errors> echo ./README.flag./README.flag> chown {$whoami} README.flag chown: unknown user {$whoami}> hostnamejail-0> chown jail-0 README.flagchown: unknown user jail-0> suerror: No such file or directory> whoami -hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: whoami 
Print the user name associated with the current effective user id> whoamiwhoami: unknown uid 1338> chown README.flag unknownchown: unknown user/group README:flag
> chmoderror: No such file or directory> chown unknown README.flagchown: unknown user unknown> chown 1338 README.flag> ./README.flagerror: Permission denied> ionicenone: prio 4> ionice -hionice: unrecognized option: hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: ionice [-c 1-3] [-n 0-7] [-p PID] [PROG]
Change I/O priority and class
	-c	Class. 1:realtime 2:best-effort 3:idle	-n	Priority> mknod -hmknod: unrecognized option: hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: mknod [-m MODE] NAME TYPE [MAJOR MINOR]
Create a special file (block, character, or pipe)
	-m MODE	Creation mode (default a=rw)TYPE:	b	Block device	c or u	Character device	p	Named pipe (MAJOR MINOR must be omitted)
> stty stty: standard input: Not a tty> statBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: stat [OPTIONS] FILE...
Display file (default) or filesystem status
	-c FMT	Use the specified format	-f	Display filesystem status	-L	Follow links	-t	Terse display
FMT sequences for files: %a	Access rights in octal %A	Access rights in human readable form %b	Number of blocks allocated (see %B) %B	Size in bytes of each block reported by %b %d	Device number in decimal %D	Device number in hex %f	Raw mode in hex %F	File type %g	Group ID %G	Group name %h	Number of hard links %i	Inode number %n	File name %N	File name, with -> TARGET if symlink %o	I/O block size %s	Total size in bytes %t	Major device type in hex %T	Minor device type in hex %u	User ID %U	User name %x	Time of last access %X	Time of last access as seconds since Epoch %y	Time of last modification %Y	Time of last modification as seconds since Epoch %z	Time of last change %Z	Time of last change as seconds since Epoch
FMT sequences for file systems: %a	Free blocks available to non-superuser %b	Total data blocks %c	Total file nodes %d	Free file nodes %f	Free blocks %i	File System ID in hex %l	Maximum length of filenames %n	File name %s	Block size (for faster transfer) %S	Fundamental block size (for block counts) %t	Type in hex %T	Type in human readable form> stat ../challenge/README.flag  File: ../challenge/README.flag  Size: 28        	Blocks: 8          IO Block: 4096   regular fileDevice: 37h/55d	Inode: 3           Links: 1Access: (0400/-r--------)  Uid: ( 1338/ UNKNOWN)   Gid: ( 1338/ UNKNOWN)Access: 2019-07-14 18:33:51.000000000Modify: 2019-07-14 18:33:51.000000000Change: 2019-07-14 18:33:51.000000000
> mpstatLinux 4.15.0-1023-gcp (jail-0)	07/14/19	_x86_64_	(2 CPU)
18:36:34     CPU    %usr   %nice    %sys %iowait    %irq   %soft  %steal  %guest   %idle18:36:34     all    0.74    0.02    0.54    0.02    0.00    0.01    0.00    0.00   98.69> mpstat -hmpstat: unrecognized option: hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: mpstat [-A] [-I SUM|CPU|ALL|SCPU] [-u] [-P num|ALL] [INTERVAL [COUNT]]
Per-processor statistics
	-A			Same as -I ALL -u -P ALL	-I SUM|CPU|ALL|SCPU	Report interrupt statistics	-P num|ALL		Processor to monitor	-u			Report CPU utilization> pingBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: ping [OPTIONS] HOST
Send ICMP ECHO_REQUEST packets to network hosts
	-4,-6		Force IP or IPv6 name resolution	-c CNT		Send only CNT pings	-s SIZE		Send SIZE data bytes in packets (default 56)	-A		Ping as soon as reply is recevied	-t TTL		Set TTL	-I IFACE/IP	Source interface or IP address	-W SEC		Seconds to wait for the first response (default 10)			(after all -c CNT packets are sent)	-w SEC		Seconds until ping exits (default:infinite)			(can exit earlier with -c CNT)	-q		Quiet, only display output at start			and when finished	-p HEXBYTE	Pattern to use for payload> pidof> pidof -hpidof: unrecognized option: hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: pidof [OPTIONS] [NAME]...
List PIDs of all processes with names that match NAMEs
	-s	Show only one PID	-o PID	Omit given pid		Use %PPID to omit pid of pidof's parent> ps  PID   USER     TIME  COMMAND    1 1338      0:00 /bin/shell   19 1338      0:00 ps> psPID   USER     TIME  COMMAND    1 1338      0:00 /bin/shell   20 1338      0:00 ps> ps -efPID   USER     TIME  COMMAND    1 1338      0:00 /bin/shell   21 1338      0:00 ps -ef> setpriv BusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: setpriv [OPTIONS] PROG [ARGS]
Run PROG with different privilege settings
-d,--dump		Show current capabilities--nnp,--no-new-privs	Ignore setuid/setgid bits and file capabilities--inh-caps CAP,CAP	Set inheritable capabilities--ambient-caps CAP,CAP	Set ambient capabilities
> setprivBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: setpriv [OPTIONS] PROG [ARGS]
Run PROG with different privilege settings
-d,--dump		Show current capabilities--nnp,--no-new-privs	Ignore setuid/setgid bits and file capabilities--inh-caps CAP,CAP	Set inheritable capabilities--ambient-caps CAP,CAP	Set ambient capabilities> lzop -hlzop: unrecognized option: hBusyBox v1.29.3 (2019-01-24 07:45:07 UTC) multi-call binary.
Usage: lzop [-cfUvd123456789CF] [FILE]...
	-1..9	Compression level	-d	Decompress	-c	Write to stdout	-f	Force	-U	Delete input files	-v	Verbose	-F	Don't store or verify checksum	-C	Also write checksum of compressed block> lzop -v README.flagREADME.flag: 4294964596% - replaced with README.flag.lzo> lsORME.flagREADME.flagREADME.flag.lzo> lzop -v -c README.flag.lzo?LZO
??LZO   @??RNҡ
 0	@*??l?CTF{4ll_D474_5hhB3_Fr33}> lzop -v -c README.flag?LZO
 0	@???CTF{4ll_D474_5h4ll_B3_Fr33}
GOTTEM: CTF{4ll_D474_5h4ll_B3_Fr33}