# SSH key Hijacking> Author: @JohnHammond#6971> We put a new novel spin on the old classic game of Wordle! Now it's written in bash! :D> Oh, and you aren't guessing words, this time...
We find a **read_only** [terminal session]() logged in as `user` with `wordle_bash.sh`.We see the wordle game generates a random integer and rans modulus on the date-parts to generate a random date (fun fact, you can get dates that aren't valid dates - this should be a hint).
The critical component is the boolean check ``` if [[ $(date $guess_date) == $(date -d $TARGET_DATE +%Y-%m-%d) ]] ``` where if you run through the game (even with a valid date) the output shows `date: invalid date ‘2020-01-01’`. Here we can see that the `date` command is both missing a `-d` flag as well as proper formatting `+%Y-%m-%d` to match the `$TARGET_DATE` variable because the `==` is a string comparator in bash.
To get the `$guess_date` variable to pass custom input is the first issue here - but conveniently have been provided an `Input` option:
`echo "Please select the date you meant:" guess_date=$(gum input --placeholder $guess_date)`
We can now check [GTFOBins](https://gtfobins.github.io/gtfobins/date/) for vulnerabilities with the `date` command and see that we can specify `-f` to read the date string from a file.
Looking at the script, if we successfully guess the date the game rewards us with `"Congratulations, you've won! You correctly guessed the date!" 'Your flag is:' $(cat /root/flag.txt)` which shows us the path to our flag.txt file.
Put it all together and we get `-f /root/flag.txt` as our input string...but we get `date: /root/flag.txt: Permission denied`! So we need to read the flag using elevated permissions.
Check the `sudoers` permission with `sudo -l` to list the current user's permissions and we see `User user may run the following commands on wordle-bash...: (root) /home/user/wordle_bash.sh`. We can run the script with `sudo` - let's try.
`date: invalid date ‘[ Sorry, your flag will be displayed once you have code execution as root ]’`
We were able to read files as `root` by executing commands from within an elevated script. Let's abuse this to dump the ssh keys at `/root/.ssh/id_rsa` and `/root/.ssh/id_rsp.pub`.
Spoof our **local** ssh key and `ssh` into the server again using `ssh -i id_rsa` in order to specify we want to use our hijacked ssh key file.
Once connected we can navigate to `/root` to find the `flag.txt` accompanied by **get_flag_random_suffix_#############**
Happy hunting!
### wordle_bash.sh```#!/bin/bash
YEARS=("2020" "2021" "2022" "2023" "2024" "2025")MONTHS=("01" "02" "03" "04" "05" "06" "07" "08" "09" "10" "11" "12" )DAYS=("01" "02" "03" "04" "05" "06" "07" "08" "09" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "23" "24" "25" "26" "27" "28" "29" "30" "31")
YEARS_SIZE=${#YEARS[@]}YEARS_INDEX=$(($RANDOM % $YEARS_SIZE))YEAR=${YEARS[$YEARS_INDEX]}
MONTHS_SIZE=${#MONTHS[@]}MONTHS_INDEX=$(($RANDOM % $MONTHS_SIZE))MONTH=${MONTHS[$MONTHS_INDEX]}
DAYS_SIZE=${#DAYS[@]}DAYS_INDEX=$(($RANDOM % $DAYS_SIZE))DAY=${DAYS[$DAYS_INDEX]}
TARGET_DATE="${YEAR}-${MONTH}-${DAY}"
gum style \  --foreground 212 --border-foreground 212 --border double \  --align center --width 50 --margin "1 2" --padding "2 4" \  'WORDLE DATE' 'Uncover the correct date!'
echo "We've selected a random date, and it's up to you to guess it!"
wordle_attempts=1while [ $wordle_attempts -le 5 ]do  echo "Attempt $wordle_attempts:"  echo "Please select the year you think we've chosen:"  chosen_year=$(gum choose ${YEARS[@]})
  echo "Now, enter the month of your guess: "  chosen_month=$(gum choose ${MONTHS[@]})
  echo "Finally, enter the day of your guess: "  chosen_day=$(gum choose ${DAYS[@]})
  guess_date="$chosen_year-$chosen_month-$chosen_day"
  if ! date -d $guess_date; then    echo "Invalid date! Your guess must be a valid date in the format YYYY-MM-DD."    exit  fi
  confirmed=1  while [ $confirmed -ne 0 ]  do    gum confirm "You've entered '$guess_date'. Is that right?"    confirmed=$?    if [[ $confirmed -eq 0 ]]    then      break    fi    echo "Please select the date you meant:"    guess_date=$(gum input --placeholder $guess_date)  done
  if [[ $(date $guess_date) == $(date -d $TARGET_DATE +%Y-%m-%d) ]]; then    gum style \      --foreground 212 --border-foreground 212 --border double \      --align center --width 50 --margin "1 2" --padding "2 4" \      "Congratulations, you've won! You correctly guessed the date!" 'Your flag is:' $(cat /root/flag.txt)    exit 0  else    echo "Sorry, that wasn't correct!"    echo "====================================="  fi
  wordle_attempts=$((wordle_attempts+1))done
gum style \  --foreground 212 --border-foreground 212 --border double \  --align center --width 50 --margin "1 2" --padding "2 4" \  "Sorry, you lost." "The correct date was $TARGET_DATE."```