# Restricted
You 're still trying to collect information for your research on the alien relic. Scientists contained the memories of ancient egyptian mummies into small chips, where they could store and replay them at will. Many of these mummies were part of the battle against the aliens and you suspect their memories may reveal hints to the location of the relic and the underground vessels. You managed to get your hands on one of these chips but after you connected to it, any attempt to access its internal data proved futile. The software containing all these memories seems to be running on a restricted environment which limits your access. Can you find a way to escape the restricted environment ?
## Writeup
The docker container has a **restricted** user account with no password and has a **rbash**.
We can see it from the following lines of **DockerFile**:
```dockerfileRUN adduser --disabled-password restrictedRUN usermod --shell /bin/rbash restrictedRUN sed -i -re 's/^restricted:[^:]+:/restricted::/' /etc/passwd /etc/shadow```
Login into it:
```bashssh [email protected] -p 31637```
He can execute command from **.bin** directory that there are these programs:
```ssh  top  uptime ```
We can use **ssh** to escape from the **rbash**:
```bashssh -p 1337 restricted@localhost -t "bash --noprofile"```
We are escaped from the **rbash**, we can now cat the flag.
```bashcat /flag_*```
The flag is:
```HTB{r35tr1ct10n5_4r3_p0w3r1355}```