題目連結

https://learn.cylabacademy.org/library/189

題目解法

啟動後題目會提供目標主機名稱、使用者名稱、密碼、port 等資訊，類似下方字串： Login via ssh as ctf-player with the password, 8c606eb1 on the host wily-courier.picoctf.net and port 64506. 我們要使用 ssh 指令來連線到目標主機

ssh -p <port> <username>@<host>
ssh -p 64506 ctf-player@wily-courier.picoctf

連線後會提示確認 fingerprint 是否正確，輸入 yes 之後輸入密碼 (密碼不會顯示出來)

The authenticity of host '[wily-courier.picoctf.net]:64506 ([18.189.99.27]:64506)' can't be established.
ED25519 key fingerprint is: SHA256:ErlUUvYlrAxfSW1tIdzfOnGTBSr5OFkZvz0nMN4Vodw
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[wily-courier.picoctf.net]:64506' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
ctf-player@wily-courier.picoctf.net's password:

連線到主機後，使用 ls 指令查看當前目錄下有甚麼檔案

1
2

ctf-player@pico-chall$ ls
1of3.flag.txt  instructions-to-2of3.txt

發現有兩個檔案，包含一部份 flag 以及下一部份 flag 的提示，使用 cat 指令查看檔案內容。

1
2
3
4

ctf-player@pico-chall$ cat 1of3.flag.txt
pic-------sh_
ctf-player@pico-chall$ cat instructions-to-2of3.txt
Next, go to the root of all things, more succinctly `/`

可以看到提示下一個位置是前往根目錄 (/)，再次重複列舉檔案以及讀取檔案等步驟

1
2
3
4
5
6
7

ctf-player@pico-chall$ cd /
ctf-player@pico-chall$ ls
2of3.flag.txt  bin  boot  challenge  dev  etc  home  instructions-to-3of3.txt  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
ctf-player@pico-chall$ cat 2of3.flag.txt
0ut-------t3r_
ctf-player@pico-chall$ cat instructions-to-3of3.txt
Lastly, ctf-player, go home... more succinctly `~`

可以看到提示下一個位置是前往家目錄 (~)，再次重複列舉檔案以及讀取檔案等步驟

1
2
3
4
5

ctf-player@pico-chall$ cd ~
ctf-player@pico-chall$ ls
3of3.flag.txt  drop-in
ctf-player@pico-chall$ cat 3of3.flag.txt
0b2---4f}