1 Hello Hackers

Intro to Commands

in this challenge, you will invoke your first command When you type a command hit enter, the command will be invoked as so:

hacker@dojo:~$ whoami
hacker

Here, the user executed the whoami command, which simply prints the username (hacker) to the terminal. when the command terminates, the shell once again displays the prompt.

In this level, invoke the hello command to get the flag. Keep in mind commands in Linux are case sensitive:

Intro to Arguments

A command with arguments, which is what we call additional data passed to the command. when you type a line of text and hit enter, the shell actually parses your input into a command and its arguments. the first word is the command, and the subsequent words are arguments

hacker@dojo:~$ echo Hello
Hello
hacker@dojo:~$

In this challenge, to get the flag, you must run the hello command (NOT the echo command) with a single argument of hackers.

10 Chaining Commands

Chaining with Semicolons

hacker@chaining~chaining-with-semicolons:~$ /challenge/pwn; /challenge/college 
Yes! You chained /challenge/pwn and /challenge/college! Here is your flag:
pwn.college{A7yMweaMEKcm_uU4GJjHYRgiOUL.dVTN4QDL5cDOzIzW}

Your First Shell Script

nano x.sh
chmod +x x.sh
bash x.sh

Redirecting Script Output

hacker@chaining~redirecting-script-output:~$ bash x.sh | /challenge/solve 

Executable Shell Script

./x.sh

Arguments

bash x.sh hack the planet

The script can access these arguments using special variables:

• $1 contains the first argument (hack)
• $2 contains second argument (the)
• $3 planet

echo "$2 $1"

11 PATH

The PATH Variable

hacker@path~the-path-variable:~$ PATH=""
hacker@path~the-path-variable:~$ /challenge/run
Trying to remove /flag...
/challenge/run: line 4: rm: No such file or directory
The flag is still there! I might as well give it to you!
pwn.college{wRbakGPcobGis0pC1xEvRbL71ds.dZzNwUDL5cDOzIzW}

Setting PATH

hacker@path~setting-path:~$ PATH=/challenge/more_commands
hacker@path~setting-path:~$ /challenge/run
Invoking 'win'....
Congratulations! You properly set the flag and 'win' has launched!
pwn.college{Ue8tiUbN8FGABxhC1eYeEy_fKTc.dVzNyUDL5cDOzIzW}

Adding Commands

hacker@path~adding-commands:~$ echo "cat /flag" > win
hacker@path~adding-commands:~$ chmod +x win
hacker@path~adding-commands:~$ PATH="/home/hacker:/bin"
hacker@path~adding-commands:~$ /challenge/run
Invoking 'win'....
pwn.college{wAsJ4eMX0gXlz7v1Du1s-2fEs_t.dZzNyUDL5cDOzIzW}

Hijacking Commands

nano rm
#!/bin/bash
echo "Intercepted rm command!"
# Optionally log the command and its arguments
cat /flag
# You could avoid executing any destructive action here

hacker@path~hijacking-commands:~$ export PATH=/home/hacker:$PATH
hacker@path~hijacking-commands:~$ /challenge/run

12 Comparing files

diff compares two files line by line and shows you exactly what’s different between them

hacker@commands~comparing-files:~$ diff /challenge/decoys_
decoys_and_real.txt  decoys_only.txt      
hacker@commands~comparing-files:~$ diff /challenge/decoys_only.txt /challenge/decoys_and_real.txt 
54a55
> pwn.college{gDGa8vSu6FKwovU6LBf4Ua7BuY9.QXzAzM4EDL5cDOzIzW}
hacker@commands~comparing-files:~$ 

13 moving files

You can also move files around with mv command

mv /flag /tmp/hack-the-planet
Correct! Performing 'mv /flag /tmp/hack-the-planet'.

14 Data manipulation

Translating characters

In its most basic usage, tr translates the character provided in its first argument tot the character provided in its second argument

hacker@data~translating-characters:~$ /challenge/run | tr 'a-zA-Z' 'A-Za-z'
yOUR CASE-SWAPPED FLAG:
pwn.college{UjY0atrVNVWUJ7osd1XgFoIiVWE.QXzETM3EDL5cDOzIzW}

Deleting characters

tr can also translate characters to nothing. this is done via a -d flag and an argument of what characters to delete:

hacker@dojo:~$ echo PAWN | tr -d A
PWN
hacker@dojo:~$

hacker@data~deleting-characters:~$ /challenge/run 
Your character-stuffed flag:
p^%w^%n.^c^o%l%l^e^%g^%e^%{^%MY^%BL^H^%z^j%Q^%UO%J^%f%T%0^%W^J^%6^-%h^R^i^%Y%v^%x%h^%Y^g.^%Q^X0^E^%T%M^3E^D^L^%5^%c%D%O%z%I^z^%W^}^%
hacker@data~deleting-characters:~$ /challenge/run | tr -d %^
Your character-stuffed flag:
pwn.college{MYBLHzjQUOJfT0WJ6-hRiYvxhYg.QX0ETM3EDL5cDOzIzW}

Deleting newlines

hacker@data~deleting-newlines:~$ /challenge/run | tr -d "\\n"

Head

not the one you are thinking now, you freak

/challenge/pwn | head -n 7 | /challenge/college 

Cut

The -d argument specifies the column delimiter

/challenge/run | cut -d " " -f 2 | tr -d "\n"

Sort

hacker@data~sorting-data:~$ sort /challenge/flags.txt | tail -n 1

15 Multiplexing

Screen

screen is a program that creates virtual terminals inside your terminal. It’s somewhat like having multiple browser tabs, but for your command line

Detaching and Attaching

You detach by pressing CTRL-A followed by d

You reattach using -r argument

screen -r

Finding Sessions

screen -ls

then reattach with

screen -r session name

Switching Windows

• Ctrl-A c - Create a new window
• Ctrl-A n - Next window
• Ctrl-A p - Previous window
• Ctrl-A 0 through Ctrl-A 9 - Jump directly to window 0-9
• Ctrl-A " - bring up a selection menu of all of the windows

Tmux

I was trying to avoid it, yet its here

Everything as screen but CRTL-B instead of CTRL-A

Just like screen, tmux has windows. The key combos are different, but the concept is the same:

• Ctrl-B c - Create a new window
• Ctrl-B n - Next window
• Ctrl-B p - Previous window
• Ctrl-B 0 through Ctrl-B 9 - Jump to window 0-9
• Ctrl-B w - See a nice window picker

Tmux shows your windows at the bottom in a status bar that looks like:

[0] 0:bash* 1:bash

The * shows your current window, and each entry also shows the process that the window was created to run.

2 Pondering Paths

The Linux filesystem is a tree. That it has root (/). You refer to files ans directories by their path. A path from the the root of the filesystem starts with / and describes the set of of directories that must be descended into find the file.

The Root

You can invoke a program by providing its path on the command line. In this case, you’ll be giving the exact path, starting from / so the path would be /pwn. This style of path, one that starts with the root directory, is referred to as an “absolute path”

program and absolute paths

in the challenge directory and the challenge directory is, in turn, right in the root directory (/). The path to the challenge the directory is, thus, /challenge. The name of the challenge program in this level is run, and it lives in the /challenge directory. Thus, the path to the run challenge program is /challenge/run.

This challenge again requires you to execute it by invoking its absolute path. You'll want to execute the run file that is in the challenge directory that is, in turn, in the / directory.

Position thy self

You can navigate around directories by using the cd command and passing a path to it as an argument, as so;

hacker@dojo:~$ cd /some/new/directory
hacker@dojo:/some/new/directory$ cd /some/new/directory

This challenge will require you to execute the /challenge/run program from a specific path

**hacker@paths~position-thy-self:~$ cd /tmp
hacker@paths~position-thy-self:/tmp$ /challenge/run
Correct!!!
/challenge/run is an absolute path, invoked from the right directory!
Here is your flag:
pwn.college{IO-k54Vb80OXOP-Q3PYhlhTlVN7.dZDN1QDL5cDOzIzW}**

Position elsewhere

You can navigate around directories by using

**hacker@dojo:~$ cd /some/new/directory
hacker@dojo:/some/new/directory$ cd /some/new/directory**

This challenge will require you to execute the /challenge/run program from a specific path (which it will tell you). You'll need to cd to that directory before rerunning the challenge program

hacker@paths~position-elsewhere:/tmp$ /challenge/run
Correct!!!
/challenge/run is an absolute path, invoked from the right directory!
Here is your flag:
pwn.college{o7DWPEjKgtWvtqHVf3EA6j5xkdX.ddDN1QDL5cDOzIzW}

Position yet elsewhere

This challenge will require you to execute the /challenge/run program from a specific path

hacker@paths~position-yet-elsewhere:/proc/310/fd$ /challenge/run
Correct!!!
/challenge/run is an absolute path, invoked from the right directory!
Here is your flag:
pwn.college{kgi5dXZrYykwz6e7OtaUB-g0e8m.dhDN1QDL5cDOzIzW}
hacker@paths~position-yet-elsewhere:/proc/310/fd$

Implicit relative paths, from /…/

The current working directory does matter for relative paths

• A relative path is any path that does not start at root
• A relative path is interpreted relative to your cwd

hacker@paths~implicit-relative-paths-from-:/$ /challenge/run
Incorrect...
You invoked this challenge with an absolute path. This challenge needs a relative path!
hacker@paths~implicit-relative-paths-from-:/$ challenge/run
Correct!!!
challenge/run is a relative path, invoked from the right directory!
Here is your flag:
pwn.college{IAxNV7WMdcS6_8cAHdrs9YXgJCh.dlDN1QDL5cDOzIzW}

explicit relative paths, from ./.

In most operating systems, including Linux, every directory has two implicit entries that you can reference in paths: . and ..

The first . refers right to the same directory, so the following absolute paths are all identical to each other:

• /challenge
• /challenge/.
• /challenge/./././././././././
• /./././challenge/././

The following relative paths are also all identical to each other:

• challenge
• ./challenge
• ./././challenge
• challenge/.

This challenge will get you using . in your relative paths.

hacker@paths~explicit-relative-paths-from-:~$ /challenge/run
Incorrect...
You are not currently in the / directory.
Please use the `cd` utility to change directory appropriately.
hacker@paths~explicit-relative-paths-from-:~$ cd /
hacker@paths~explicit-relative-paths-from-:/$ /challenge/run
Incorrect...
You invoked this challenge with an absolute path. This challenge needs a relative path!
hacker@paths~explicit-relative-paths-from-:/$ ../challenge/run
Correct!!!
../challenge/run is a relative path, invoked from the right directory!
Here is your flag:
pwn.college{kND55Q3o3scrdO90TzfgdBoNgLH.dBTN1QDL5cDOzIzW}
hacker@paths~explicit-relative-paths-from-:/$ 

implicit relative path

Linux explicitly avoids automatically looking in the current directory when you provide a naked path

hacker@dojo:~$ cd /challenge
hacker@dojo:/challenge$ run

hacker@paths~implicit-relative-path:~$ cd /challenge/
hacker@paths~implicit-relative-path:/challenge$ run
bash: run: command not found

hacker@paths~implicit-relative-path:/challenge$ 
hacker@paths~implicit-relative-path:/challenge$ ./run
Correct!!!
./run is a relative path, invoked from the right directory!
Here is your flag:
pwn.college{AqHtdCPE2Ui_Bf0lspjH-KVSj4N.dFTN1QDL5cDOzIzW}

home sweet home

Typically, your shell session will start with your home directory as your current working directory.

The ~ in this prompt is the current working directory, with ~ being shorthand for /home/hacker. Bash provides and uses this shorthand because, again, most of your time will be spent in your home directory. Thus, whenever bash sees ~ provided as the start of an argument in a way consistent with a path, it will expand it to your home directory. Consider:

hacker@dojo:~$ echo LOOK: ~
LOOK: /home/hacker
hacker@dojo:~$ cd /
hacker@dojo:/$ cd ~
hacker@dojo:~$ cd ~/asdf
hacker@dojo:~/asdf$ cd ~/asdf
hacker@dojo:~/asdf$ cd ~
hacker@dojo:~$ cd /home/hacker/asdf
hacker@dojo:~/asdf$

Note that the expansion of ~ is an absolute path, and only the leading ~ is expanded. This means, for example, that ~/~ will be expanded to /home/hacker/~ rather than /home/hacker/home/hacker.

Fun fact: cd will use your home directory as the default destination:

hacker@dojo:~$ cd /tmp
hacker@dojo:/tmp$ cd
hacker@dojo:~$

Now it's your turn to play! In this challenge, /challenge/run will write a copy of the flag to any file you specify as an argument on the commandline, with these constraints:

1. Your argument must be an absolute path.
2. The path must be inside your home directory.
3. Before expansion, your argument must be three characters or less.

hacker@paths~home-sweet-home:~$ /challenge/run ~/a
Writing the file to /home/hacker/a!
... and reading it back to you:
pwn.college{sq5oaDI17I7bYyjmA0ullb1KUhF.dNzM4QDL5cDOzIzW}

3 Comprehending Commands

1 root root 4096 Oct 24 10:50 challenge drwxr-xr-x 6 root root 380 Oct 24 10:50 dev drwxr-xr-x 1 root root 4096 Oct 24 10:50 etc drwxr-xr-x 1 root root 4096 Oct 4 23:05 home lrwxrwxrwx 1 root root

cat: not the pet

One of the most critical Linux commands is cat. cat is most often used for reading out files, like so:

hacker@dojo:~$ cat /challenge/DESCRIPTION.md
One of the most critical Linux commands is `cat`.
`cat` is most often used for reading out files, like so:

cat will concatenate (hence the name) multiple files if provided multiple arguments. For example:

hacker@dojo:~$ cat myfile
This is my file!
hacker@dojo:~$ cat yourfile
This is your file!
hacker@dojo:~$ cat myfile yourfile
This is my file!
This is your file!
hacker@dojo:~$ cat myfile yourfile myfile
This is my file!
This is your file!
This is my file!

Finally, if you give no arguments at all, cat will read from the terminal input and output it. We'll explore that in later challenges...

In this challenge, I will copy the flag to the flag file in your home directory

hacker@commands~cat-not-the-pet-but-the-command:~$ cat flag
pwn.college{cysI7vWtNlJDT1IJtep3pDbrvb0.dFzN1QDL5cDOzIzW}
hacker@commands~cat-not-the-pet-but-the-command:~$

Catting absolute paths

You can read it with cat at its absolute path: /flag.

---

FUN FACT:/flag is where the flag always lives in pwn.college, but unlike in this challenge, you typically can't access that file directly.

hacker@commands~catting-absolute-paths:~$ cat /flag
pwn.college{wQFOkzyJJ-LdUDa3il06LvAkv38.dlTM5QDL5cDOzIzW}

grepping for a needle in a haystack

There are many ways to grep

hacker@dojo:~$ grep SEARCH_STRING /path/to/file

Invoked like this, grep will search the file for lines of text containing SEARCH_STRING and print them to the console.

In this challenge, I've put a hundred thousand lines of text into the /challenge/data.txt file. Grep it for the flag!

HINT: The flag always starts with the text pwn.college.

hacker@commands~grepping-for-a-needle-in-a-haystack:~$ grep pwn /challenge/data.txt
pwned
pwn.college{Yk2OpnpdkPvwOLWA6kmE1AdFXuc.ddTM4QDL5cDOzIzW}

Listing files

ls will list files in all the directories provided to it as arguments, and in the current directory if no arguments are provided. Observe:

hacker@dojo:~$ ls /challenge
run
hacker@dojo:~$ ls
Desktop    Downloads  Pictures  Templates
Documents  Music      Public    Videos
hacker@dojo:~$ ls /home/hacker
Desktop    Downloads  Pictures  Templates
Documents  Music      Public    Videos
hacker@dojo:~$

In this challenge, we've named /challenge/run with some random name! List the files in /challenge to find it.

hacker@commands~listing-files:~$ ls /challenge/
8101-renamed-run-7214  DESCRIPTION.md
hacker@commands~listing-files:~$ /challenge/8101-renamed-run-7214
Yahaha, you found me! Here is your flag:
pwn.college{QeofiUWcoAlzO2JTZPfn9QsFATz.dhjM4QDL5cDOzIzW}

Touching files

You can create a new, blank file by touching it with the touch command:

hacker@dojo:~$ cd /tmp
hacker@dojo:/tmp$ ls
hacker@dojo:/tmp$ touch pwnfile
hacker@dojo:/tmp$ ls
pwnfile
hacker@dojo:/tmp$

It's that simple! In this level, please create two files: /tmp/pwn and /tmp/college, and run /challenge/run to get your flag!

hacker@commands~touching-files:~$ cd /tmp
hacker@commands~touching-files:/tmp$ touch pwn
hacker@commands~touching-files:/tmp$ touch college
hacker@commands~touching-files:/tmp$ /challenge/run
Success! Here is your flag:
pwn.college{kR2ia2xlpUy-XXH-NblDkV8kQWe.dBzM4QDL5cDOzIzW}

Removing files

In Linux, you remove files with the rm command, as so:

hacker@dojo:~$ touch PWN
hacker@dojo:~$ touch COLLEGE
hacker@dojo:~$ ls
COLLEGE     PWN
hacker@dojo:~$ rm PWN
hacker@dojo:~$ ls
COLLEGE
hacker@dojo:~$

Let's practice. This challenge will create a delete_me file in your home directory! Delete it, then run /challenge/check, which will make sure you've deleted it and then give you the flag!

hacker@commands~removing-files:~$ rm delete_me
hacker@commands~removing-files:~$ /challenge/check
Excellent removal. Here is your reward:
pwn.college{sY6Lh6cfGoVR6rQdXP44p4zaBwK.dZTOwUDL5cDOzIzW}

Hidden files

Linux has a convention where files that start with a . don't show up by default in ls and in a few other contexts. To view them with ls, you need to invoke ls with the -a flag, as so:

hacker@dojo:~$ touch pwn
hacker@dojo:~$ touch .college
hacker@dojo:~$ ls
pwn
hacker@dojo:~$ ls -a
.college	pwn
hacker@dojo:~$

Now, it's your turn! Go find the flag, hidden as a dot-prepended file in /.

hacker@commands~hidden-files:~$ ls -la /
total 88
drwxr-xr-x    1 root root 4096 Oct 24 09:45 .
drwxr-xr-x    1 root root 4096 Oct 24 09:45 ..
-rwxr-xr-x    1 root root    0 Oct 24 09:45 .dockerenv
-rw-r--r--    1 root root   58 Oct 24 09:45 .flag-319952114329315
lrwxrwxrwx    1 root root    7 May 30 02:03 bin -> usr/bin
drwxr-xr-x    1 root root 4096 Apr 15  2020 boot
drwxr-xr-x    1 root root 4096 Oct 24 09:45 challenge
drwxr-xr-x    6 root root  380 Oct 24 09:45 dev
drwxr-xr-x    1 root root 4096 Oct 24 09:45 etc
drwxr-xr-x    1 root root 4096 Oct  4 23:05 home
lrwxrwxrwx    1 root root    7 May 30 02:03 lib -> usr/lib
lrwxrwxrwx    1 root root    9 May 30 02:03 lib32 -> usr/lib32
lrwxrwxrwx    1 root root    9 May 30 02:03 lib64 -> usr/lib64
lrwxrwxrwx    1 root root   10 May 30 02:03 libx32 -> usr/libx32
drwxr-xr-x    1 root root 4096 May 30 02:03 media
drwxr-xr-x    1 root root 4096 May 30 02:03 mnt
drwxr-xr-x    4 root root 4096 Sep  6 16:54 nix
drwxr-xr-x    1 root root 4096 Sep  6 16:43 opt
dr-xr-xr-x 2253 root root    0 Oct 24 09:45 proc
drwx------    1 root root 4096 Sep  6 16:44 root
drwxr-xr-x    1 root root 4096 Oct 24 09:45 run
lrwxrwxrwx    1 root root    8 May 30 02:03 sbin -> usr/sbin
drwxr-xr-x    1 root root 4096 May 30 02:03 srv
dr-xr-xr-x   13 root root    0 Sep 16 00:15 sys
drwxrwxrwt    1 root root 4096 Oct 24 09:45 tmp
drwxr-xr-x    1 root root 4096 Sep  6 16:19 usr
drwxr-xr-x    1 root root 4096 May 30 02:07 var
hacker@commands~hidden-files:~$ cat /.flag-319952114329315
pwn.college{cxh3TzLhXjJALbIMTfC_EoElvtx.dBTN4QDL5cDOzIzW}
hacker@commands~hidden-files:~$

Filesystem Quest

We'll start it out in /. Normally:

hacker@dojo:~$ cd /
hacker@dojo:/$ ls
bin   challenge  etc   home  lib32  libx32  mnt  proc  run   srv  tmp  var
boot  dev        flag  lib   lib64  media   opt  root  sbin  sys  usr

That's a lot of contents! One day, you will be quite familiar with them, but already, you might recognize the flag file and the challenge directory.

In this challenge, I have hidden the flag! Here, you will use ls and cat to follow my breadcrumbs and find it! Here's how it'll work:

1. Your first clue is in /. Head on over there.
2. Look around with ls. There'll be a file named HINT or CLUE or something along those lines!
3. cat that file to read the clue!
4. Depending on what the clue says, head on over to the next directory (or don't!).
5. Follow the clues to the flag!

Good luck!

fuckit..its too long but it was here:

hacker@commands~an-epic-filesystem-quest:~$ cat /opt/linux/linux
-5.4/drivers/net/wireless/intel/HINT
CONGRATULATIONS! Your perserverence has paid off, and you have found the flag!
It is: pwn.college{ogtR3jCGG3VRL_QiP5qDmBpeCTb.dljM4QDL5cDOzIzW}

Making directories

You make directories using the mkdir command. Then you can stick files in there!

Watch:

hacker@dojo:~$ cd /tmp
hacker@dojo:/tmp$ ls
hacker@dojo:/tmp$ ls
hacker@dojo:/tmp$ mkdir my_directory
hacker@dojo:/tmp$ ls
my_directory
hacker@dojo:/tmp$ cd my_directory
hacker@dojo:/tmp/my_directory$ touch my_file
hacker@dojo:/tmp/my_directory$ ls
my_file
hacker@dojo:/tmp/my_directory$ ls /tmp/my_directory/my_file
/tmp/my_directory/my_file
hacker@dojo:/tmp/my_directory$

Now, go forth and create a /tmp/pwn directory and make a college file in it! Then run /challenge/run, which will check your solution and give you the flag!

hacker@commands~making-directories:/tmp/pwn$ /challenge/run
Success! Here is your flag:
pwn.college{kTdrZEx6pCM1gjtTDnXWFG5rOYL.dFzM4QDL5cDOzIzW}

finding files

The find command takes optional arguments describing the search criteria and the search location. If you don't specify a search criteria, find matches every file. If you don't specify a search location, find uses the current working directory (.). For example:

hacker@dojo:~$ mkdir my_directory
hacker@dojo:~$ mkdir my_directory/my_subdirectory
hacker@dojo:~$ touch my_directory/my_file
hacker@dojo:~$ touch my_directory/my_subdirectory/my_subfile
hacker@dojo:~$ find
.
./my_directory
./my_directory/my_subdirectory
./my_directory/my_subdirectory/my_subfile
./my_directory/my_file
hacker@dojo:~$

And when specifying the search location:

hacker@dojo:~$ find my_directory/my_subdirectory
my_directory/my_subdirectory
my_directory/my_subdirectory/my_subfile
hacker@dojo:~$

And, of course, we can specify the criteria! For example, here, we filter by name:

hacker@dojo:~$ find -name my_subfile
./my_directory/my_subdirectory/my_subfile
hacker@dojo:~$ find -name my_subdirectory
./my_directory/my_subdirectory
hacker@dojo:~$

You can search the whole filesystem if you want!

hacker@dojo:~$ find / -name hacker
/home/hacker
hacker@dojo:~$

Now it's your turn. I've hidden the flag in a random directory on the filesystem. It's still called flag. Go find it!

Several notes. First, there are other files named flag on the filesystem. Don't panic if the first one you try doesn't have the actual flag in it. Second, there're plenty of places in the filesystem that are not accessible to a normal user. These will cause find to generate errors, but you can ignore those; we won't hide the flag there! Finally, find can take a while; be patient!

hacker@commands~finding-files:~$ find / -name flag 2>/dev/null
/usr/local/lib/python3.8/dist-packages/pwnlib/flag
/usr/local/share/radare2/5.9.5/flag
/usr/lib/python3/dist-packages/twisted/plugins/__pycache__/flag
/opt/pwndbg/.venv/lib/python3.8/site-packages/pwnlib/flag
/opt/radare2/libr/flag
/nix/store/pmvk2bk4p550w182rjfm529kfqddnvh3-python3.11-pwntools-4.12.0/lib/python3.11/site-packages/pwnlib/flag
/nix/store/1yagn5s8sf7kcs2hkccgf8d0wxlrv5sz-radare2-5.9.0/share/radare2/5.9.0/flag
hacker@commands~finding-files:~$ ^C
hacker@commands~finding-files:~$ cat /usr/local/share/radare2/5.9.5/flag
cat: /usr/local/share/radare2/5.9.5/flag: Is a directory
hacker@commands~finding-files:~$ ls -l /
total 76
lrwxrwxrwx    1 root root    7 May 30 02:03 bin -> usr/bin
drwxr-xr-x    1 root root 4096 Apr 15  2020 boot
drwxr-xr-x    1 root root 4096 Oct 24 10:50 challenge
drwxr-xr-x    6 root root  380 Oct 24 10:50 dev
drwxr-xr-x    1 root root 4096 Oct 24 10:50 etc
drwxr-xr-x    1 root root 4096 Oct  4 23:05 home
lrwxrwxrwx    1 root root    7 May 30 02:03 lib -> usr/lib
lrwxrwxrwx    1 root root    9 May 30 02:03 lib32 -> usr/lib32
lrwxrwxrwx    1 root root    9 May 30 02:03 lib64 -> usr/lib64
lrwxrwxrwx    1 root root   10 May 30 02:03 libx32 -> usr/libx32
drwxr-xr-x    1 root root 4096 May 30 02:03 media
drwxr-xr-x    1 root root 4096 May 30 02:03 mnt
drwxr-xr-x    4 root root 4096 Sep  6 16:54 nix
drwxr-xr-x    1 root root 4096 Sep  6 16:43 opt
dr-xr-xr-x 2280 root root    0 Oct 24 10:50 proc
drwx------    1 root root 4096 Sep  6 16:44 root
drwxr-xr-x    1 root root 4096 Oct 24 10:50 run
lrwxrwxrwx    1 root root    8 May 30 02:03 sbin -> usr/sbin
drwxr-xr-x    1 root root 4096 May 30 02:03 srv
dr-xr-xr-x   13 root root    0 Sep 16 00:15 sys
drwxrwxrwt    1 root root 4096 Oct 24 10:50 tmp
drwxr-xr-x    1 root root 4096 Sep  6 16:19 usr
drwxr-xr-x    1 root root 4096 May 30 02:07 var
hacker@commands~finding-files:~$ cat /usr/lib/python3/dist-packages/twisted/plugins/__pycache__/flag

Linking files

Links come in two flavors: hard and soft (also known as symbolic) links. We'll differentiate the two with an analogy:

• A hard link is when you address your appartment using multiple addresses that all lead directly to the same place (e.g., Apt 2 vs Unit 2).
• A soft link is when you move appartments and have the postal service automatically forward your mail from your old place to your new place.

In a filesystem, a file is, conceptually, an address at which the contents of that file live. A hard link is an alternate address that indexes that data --- accesses to the hard link and accesses to the original file are completely identical, in that they immediate yield the necessary data. A soft/symbolic link, instead, contains the original file name. When you access the symbolic link, Linux will realize that it is a symbolic link, read the original file name, and then (typically) automatically access that file. In most cases, both situations result in accessing the original data, but the mechanisms are different.

Hard links sound simpler to most people (case in point, I explained it in one sentence above, versus two for soft links), but they have various downsides and implementation gotchas that make soft/symbolic links, by far, the more popular alternative.

In this challenge, we will learn about symbolic links (also also known as symlinks). Symbolic links are created with the ln command with the -s argument, like so:

hacker@dojo:~$ cat /tmp/myfile
This is my file!
hacker@dojo:~$ ln -s /tmp/myfile /home/hacker/ourfile
hacker@dojo:~$ cat ~/ourfile
This is my file!
hacker@dojo:~$

You can see that accessing the symlink results in getting the original file contents! Also, you can see the usage of ln -s. Note that the original file path comes before the link path in the command!

A symlink can be identified as such with a few methods. For example, the file command, which takes a filename and tells you what type of file it is, will recognize symlinks:

hacker@dojo:~$ file /tmp/myfile
/tmp/myfile: ASCII text
hacker@dojo:~$ file ~/ourfile
/home/hacker/ourfile: symbolic link to /tmp/myfile
hacker@dojo:~$

Okay, now you try it! In this level the flag is, as always, in /flag, but /challenge/catflag will instead read out /home/hacker/not-the-flag. Use the symlink, and fool it into giving you the flag

hacker@commands~linking-files:~$ ln -s /flag /home/hacker/not-the-flag
hacker@commands~linking-files:~$ /challenge/catflag
About to read out the /home/hacker/not-the-flag file!
pwn.college{MWoOci77_tIYTdyuOelpkMPlLEe.dlTM1UDL5cDOzIzW}

4 File Globbing

Matching with *

When it encounters a * character in any argument, the shell will treat it as “wildcard” and try to replace that argument with any files that match the pattern:

hacker@dojo:~$ touch file_a
hacker@dojo:~$ touch file_b
hacker@dojo:~$ touch file_c
hacker@dojo:~$ ls
file_a	file_b	file_c
hacker@dojo:~$ echo Look: file_*
Look: file_a file_b file_c

The * matches any part of the file name except for / or leading . character:

hacker@dojo:~$ echo ONE: /ho*/*ck*
ONE: /home/hacker
hacker@dojo:~$ echo TWO: /*/hacker
TWO: /home/hacker
hacker@dojo:~$ echo THREE: ../*
THREE: ../hacker

Now, practice this yourself! Starting from your home directory, change your directory to /challenge, but use globbing to keep the argument you pass to cd to at most four characters! Once you're there, run /challenge/run for the flag!

hacker@globbing~matching-with-:~$ cd /challenge/
You specified the path to 'cd' to in more than 4 characters. Disallowed!
This challenge resets your working directory to /home/hacker unless you change
directory properly...

hacker@globbing~matching-with-:~$ cd /ch*
hacker@globbing~matching-with-:/challenge$ ./run
You ran me with the working directory of /challenge! Here is your flag:
pwn.college{8BurQmrcI_0dvWRjnheuwg3wZoj.dFjM4QDL5cDOzIzW}

Matching with ?

When it encounters a ? character in any argument, the shell will treat it as single-character wildcard. This works like *, but only matches one character. For example:

hacker@dojo:~$ touch file_a
hacker@dojo:~$ touch file_b
hacker@dojo:~$ touch file_cc
hacker@dojo:~$ ls
file_a	file_b	file_cc
hacker@dojo:~$ echo Look: file_?
Look: file_a file_b
hacker@dojo:~$ echo Look: file_??
Look: file_cc

Now, practice this yourself! Starting from your home directory, change your directory to /challenge, but use the ? character instead of c and l in the argument to cd! Once you're there, run /challenge/run for the flag

hacker@globbing~matching-with-:~$ cd /challenge/
You used either the 'c', 'l', or '*' characters. Disallowed!
This challenge resets your working directory to /home/hacker unless you change
directory properly...

hacker@globbing~matching-with-:~$ cd /?ha??enge
hacker@globbing~matching-with-:/challenge$ ./run
You ran me with the working directory of /challenge! Here is your flag:
pwn.college{g3SZ3zvpKzDInXmX7pkiSW2oWfQ.dJjM4QDL5cDOzIzW}

Matching with []

The square brackets are, essentially, a limited form of ?. in that instead of matching any character, [] is a wildcard for some subset of potential characters, specified within the brackets. For example, [pwn] will match the character p,w or n

hacker@dojo:~$ touch file_a
hacker@dojo:~$ touch file_b
hacker@dojo:~$ touch file_c
hacker@dojo:~$ ls
file_a	file_b	file_c
hacker@dojo:~$ echo Look: file_[ab]
Look: file_a file_b

Try it here!We've placed a bunch of files in /challenge/files. Change your working directory to /challenge/files and run /challenge/run with a single argument that bracket-globs into file_b, file_a, file_s, and file_h!

hacker@globbing~matching-with-:/challenge/files$ /challenge/run file_[abhs]
You got it! Here is your flag!
pwn.college{ECfCgbBuQ5DwoaKVBw962s1hhmZ.dNjM4QDL5cDOzIzW}

Matching paths with []

Globbing happens on a path basis, so you can expand entire paths with your globbed arguments:

hacker@dojo:~$ touch file_a
hacker@dojo:~$ touch file_b
hacker@dojo:~$ touch file_c
hacker@dojo:~$ ls
file_a	file_b	file_c
hacker@dojo:~$ echo Look: /home/hacker/file_[ab]
Look: /home/hacker/file_a /home/hacker/file_b

Now it's your turn. Once more, we've placed a bunch of files in /challenge/files. Starting from your home directory, run /challenge/run with a single argument that bracket-globs into the absolute paths to the file_b, file_a, file_s, and file_h files!

hacker@globbing~matching-paths-with-:~$ /challenge/run /challenge/files/file_[abhs]
You got it! Here is your flag!
pwn.college{gnBeXUKFxu4w0cKgsLhBa642V4c.dRjM4QDL5cDOzIzW}
hacker@globbing~matching-paths-with-:~$

Exclusionary globbing

If the first character in the is an ! and ^, the glob inverts, and bracket instance matches characters that aren’t listed

hacker@dojo:~$ touch file_a
hacker@dojo:~$ touch file_b
hacker@dojo:~$ touch file_c
hacker@dojo:~$ ls
file_a	file_b	file_c
hacker@dojo:~$ echo Look: file_[!ab]
Look: file_c
hacker@dojo:~$ echo Look: file_[^ab]
Look: file_c
hacker@dojo:~$ echo Look: file_[ab]
Look: file_a file_b

Armed with this knowledge, go forth to /challenge/files and run /challenge/run with all files that don't start with p, w, or n!

NOTE: The ! character has a different special meaning in bash when it's not the first character of a [] glob, so keep that in mind if things stop making sense! ^ does not have this problem, but is also not compatible with older shells.

hacker@globbing~exclusionary-globbing:/challenge/files$ /challenge/run [!pwn]*
You got it! Here is your flag!
pwn.college{4kiYARaSOAButXs57kaknN_zT6a.dZjM4QDL5cDOzIzW}

Multiple globs

Bash supports the expansion of multiple globs in a single word for example

cat /*fl*

what happens above is that the shell looks for all files in / that start with anything (including nothing), then have an f and an l, and end in anything

hacker@globbing~multiple-globs:/challenge/files$ /challenge/run *
Your expansion did not expand to the requested files (happy optimistic pwning 
splendid uplifting).
Instead, it expanded to:
amazing beautiful challenging delightful educational fantastic great happy incredible jovial kind laughing magical nice optimistic pwning queenly radiant splendid thrilling uplifting victorious wonderful xenial youthful zesty
hacker@globbing~multiple-globs:/challenge/files$ /challenge/run *p*
You got it! Here is your flag!
pwn.college{kpxkgGUXyKi8mJgtDvfzq94vbf7.QXycTO2EDL5cDOzIzW}

Tab completion

cat file that’s it

hacker@globbing~tab-completion:~$ ls /challenge/
DESCRIPTION.md  pwncollege
hacker@globbing~tab-completion:~$ cat /challenge/pwncollege 
pwn.college{4F7izkxGRovA3CYBTZ5XapmYWEY.QX0QTM3EDL5cDOzIzW}
hacker@globbing~tab-completion:~$ 

5 Piping

Redirecting output

You can accomplish this with the > character, as so:

hacker@dojo:~$ echo hi > asdf

In this challenge, you must use this input redirection to write the word PWN (all uppercase) to the filename COLLEGE (all uppercase).

hacker@piping~redirecting-output:~$ echo PWN > COLLEGE
Correct! You successfully redirected 'PWN' to the file 'COLLEGE'! Here is your 
flag:
pwn.college{IVL-kUz2uYQ3RwA_OlK1CjlV_Ex.dRjN1QDL5cDOzIzW}

Redirecting more output

In this level, /challenge/run will once more give you a flag, but only if you redirect its output to the file myflag. Your flag will, of course, end up in the myflag file!

You'll notice that /challenge/run will still happily print to your terminal, despite you redirecting stdout. That's because it communicates its instructions and feedback over standard error, and only prints the flag over standard out!

hacker@piping~redirecting-more-output:~$ /challenge/run > myflag
[INFO] WELCOME! This challenge makes the following asks of you:
[INFO] - the challenge will check that output is redirected to a specific file path : myflag
[INFO] - the challenge will output a reward file if all the tests pass : /flag

[HYPE] ONWARDS TO GREATNESS!

[INFO] This challenge will perform a bunch of checks.
[INFO] If you pass these checks, you will receive the /flag file.

[TEST] You should have redirected my stdout to a file called myflag. Checking...

[PASS] The file at the other end of my stdout looks okay!
[PASS] Success! You have satisfied all execution requirements.
hacker@piping~redirecting-more-output:~$ cat myflag 

[FLAG] Here is your flag:
[FLAG] pwn.college{4FHCheb4rniS5O59YlCoaCsEe28.dVjN1QDL5cDOzIzW}

Appending output

You can redirect input in append mode using >> instead of >:

hacker@dojo:~$ echo pwn > outfile
hacker@dojo:~$ echo college >> outfile
hacker@dojo:~$ cat outfile
pwn
college
hacker@dojo:$

The practice will write the first half of the flag to the file, and the second half to stdout if stdout is redirected to the file. If you properly redirect in append-mode, the second half will be appended to the first, but if you redirect in truncation mode (>), the second half will overwrite the first and you won't get the flag!

hacker@piping~appending-output:~$ /challenge/run >> /home/hacker/the-flag
[INFO] WELCOME! This challenge makes the following asks of you:
[INFO] - the challenge will check that output is redirected to a specific file path : /home/hacker/the-flag

[HYPE] ONWARDS TO GREATNESS!

[INFO] This challenge will perform a bunch of checks.
[INFO] Good luck!

[TEST] You should have redirected my stdout to a file called /home/hacker/the-flag. Checking...

[HINT] File descriptors are inherited from the parent, unless the FD_CLOEXEC is set by the parent on the file descriptor.
[HINT] For security reasons, some programs, such as python, do this by default in certain cases. Be careful if you are
[HINT] creating and trying to pass in FDs in python.

[PASS] The file at the other end of my stdout looks okay!
[PASS] Success! You have satisfied all execution requirements.
I will write the flag in two parts to the file /home/hacker/the-flag! I'll do 
the first write directly to the file, and the second write, I'll do to stdout 
(if it's pointing at the file). If you redirect the output in append mode, the 
second write will append to (rather than overwrite) the first write, and you'll 
get the whole flag!
hacker@piping~appending-output:~$ cat the-flag 
 | 
\|/ This is the first half:
 v 
pwn.college{o7TYUvRJPTI21lEKda2nbSo5ZzC.ddDM5QDL5cDOzIzW}
                              ^
     that is the second half /|\
                              |

If you only see the second half above, you redirected in *truncate* mode (>) 
rather than *append* mode (>>), and so the write of the second half to stdout 
overwrote the initial write of the first half directly to the file. Try append 
mode!

Redirecting errors

A File Descriptor (FD)number is a number that describes a communication channel in Linux

• FD 0: standard Input
• FD 1: Standard output
• FD 2: Standard Error

When you redirect process communication, you do it by FD number:

hacker@dojo:~$ echo hi 1> asdf

Redirecting errors is pretty easy from this point. If you have a command that might produce data via standard error (such as /challenge/run), you can do:

hacker@dojo:~$ /challenge/run 2> errors.log

Let's put this into practice! In this challenge, you will need to redirect the output of /challenge/run, like before, to myflag, and the "errors" (in our case, the instructions) to instructions. You'll notice that nothing will be printed to the terminal, because you have redirected everything! You can find the instructions/feedback in instructions and the flag in myflag when you successfully pull this off!

hacker@piping~redirecting-errors:~$ /challenge/run > myflag 2> instructions
hacker@piping~redirecting-errors:~$ cat myflag 

[FLAG] Here is your flag:
[FLAG] pwn.college{IKNHFfHsTFpTtoM5LVfsFGO2U5P.ddjN1QDL5cDOzIzW}

Redirecting input

This is done using <, as so:

hacker@dojo:~$ echo yo > message
hacker@dojo:~$ cat message
yo
hacker@dojo:~$ rev < message
oy

hacker@piping~redirecting-input:~$ echo COLLEGE > PWN
hacker@piping~redirecting-input:~$ /challenge/run < PWN
Reading from standard input...
Correct! You have redirected the PWN file into my standard input, and I read 
the value 'COLLEGE' out of it!
Here is your flag:
pwn.college{sOCdxWzhoTtR4xVgnrnnBP70Am4.dBzN1QDL5cDOzIzW}

Grepping stored results

OK at this point I was tired and bored I did not want to document everything, so from now hence forth I will just provide a solution in bash

hacker@piping~grepping-stored-results:~$ /challenge/run 1> /tmp/data.txt
hacker@piping~grepping-stored-results:~$ grep pwn /tmp/data.txt

Grepping live output

hacker@piping~grepping-live-output:~$ /challenge/run | grep pwn

Grepping Errors

hacker@piping~grepping-errors:~$ /challenge/run 2>&1 | grep pwn

Duplicating piped data with tee

/challenge/pwn --help
Processing...
You must pipe the output of /challenge/pwn into /challenge/college (or 'tee' 

hacker@piping~duplicating-piped-data-with-tee:~$ /challenge/pwn | tee intercepted_output | /challenge/college
Processing...
The input to 'college' does not contain the correct secret code! This code 
should be provided by the 'pwn' command. HINT: use 'tee' to intercept the 
output of 'pwn' and figure out what the code needs to be.
hacker@piping~duplicating-piped-data-with-tee:~$ cat intercepted_output 
Usage: /challenge/pwn --secret [SECRET_ARG]

SECRET_ARG should be "cQoFMh7V"

hacker@piping~duplicating-piped-data-with-tee:~$ /challenge/pwn --secret cQoFMh7V | /challenge/college
Processing...
Correct! Passing secret value to /challenge/college...
Great job! Here is your flag:
pwn.college{cQoFMh7V37A5fYRo16cbelPfz1n.dFjM5QDL5cDOzIzW}

Process substitution for input

hacker@piping~process-substitution-for-input:~$ diff <(/challenge/print_decoys) <(/challenge/print_decoys_and_flag)
2a3

Named pipes

You can also create your own persistent named pipes that stick around on the filesystem These are called FIFOs

You create A FIFO using the mkfifo command:

hacker@piping~named-pipes:~$ mkfifo mypipe
hacker@piping~named-pipes:~$ ls -la mypipe 
prw-r--r-- 1 hacker hacker 0 Sep  6 18:12 mypipe
hacker@piping~named-pipes:~

Notice the p at the beginning of the permissions - that indicates its a pipe

Unlike the automatic named pipes from process substitution:

• You can control where FIF0s are created
• They persist until you delete them
• Any process can write to them by path
• You can see them with ls and examine them like files

This challenge will be a simple introduction to FIFOs. You'll need to create a /tmp/flag_fifo file and redirect the stdout of /challenge/run to it. If you're successful, /challenge/run will write the flag into the FIFO! Go do it!

acker@piping~named-pipes:~$ mkfifo /tmp/flag_info
hacker@piping~named-pipes:~$ /challenge/run > /tmp/flag_info
WARNING: you are not redirecting /challenge/run to /tmp/flag_fifo, but to 
/tmp/flag_info.

hacker@piping~named-pipes:~$ cat /tmp/flag_fifo 
You've correctly redirected /challenge/run's stdout to a FIFO at 
/tmp/flag_fifo! Here is your flag:
pwn.college{AYSfWuNHmEi7nzWRznrRDrficNv.QXzMzM4EDL5cDOzIzW}

6 Shell Variables

Print Variables

hacker@variables~printing-variables:~$ echo $PWD
/home/hacker
hacker@variables~printing-variables:~$ echo $FLAG
pwn.college{geQJIQgI2Rpnhtl83Peh5zMAtEi.ddTN1QDL5cDOzIzW}
hacker@variables~printing-variables:~$ 

Setting Variables

hacker@variables~setting-variables:~$ VAR=1337
hacker@variables~setting-variables:~$ 
hacker@variables~setting-variables:~$ echo $VAR
1337
hacker@variables~setting-variables:~$ PWN=COLLEGE
You've set the PWN variable properly! As promised, here is the flag:
pwn.college{IPJRz0rNOvyTC75vVJgakt31c4r.dlTN1QDL5cDOzIzW}

Exporting Variables

hacker@variables~exporting-variables:~$ export PWN=COLLEGE; COLLEGE="PWN"; /challenge/run
CORRECT!
You have exported PWN=COLLEGE and set, but not exported, COLLEGE=PWN. Great 
job! Here is your flag:
pwn.college{Q6hTBN8VAlx2TZvZuCvnbOvp8c_.dJjN1QDL5cDOzIzW}
You've set the PWN variable to the proper value!
You've set the COLLEGE variable to the proper value!

Printing Variables

env

Storing Command Output

hacker@variables~storing-command-output:~$ PWN=$(/challenge/run)
Congratulations! You have read the flag into the PWN variable. Now print it out 
and submit it!
hacker@variables~storing-command-output:~$ echo "$PWN"
pwn.college{AfwEJv-IbIxd1L_D7WXNzkGfvMi.dVzN0UDL5cDOzIzW}

Reading input

hacker@variables~reading-input:~$ read -p "INPUT: " PWN
INPUT: COLLEGE
You've set the PWN variable properly! As promised, here is the flag:
pwn.college{4ZVbmTb_QDnFUORqHYuXSdAL9_9.dhzN1QDL5cDOzIzW}

7 Processes and jobs

Listing processes

hacker@processes~listing-processes:~$ ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 18:14 ?        00:00:00 /sbin/docker-init -- /nix/var/nix/profiles/default/b
root           7       1  0 18:14 ?        00:00:00 /run/dojo/bin/sleep 6h
root          68       1  0 18:14 ?        00:00:00 /challenge/7499-run-25632
root          72      68  0 18:14 ?        00:00:00 sleep 6h
hacker        73       0  0 18:14 pts/0    00:00:00 /run/dojo/bin/ssh-entrypoint
hacker        90       0  0 18:14 pts/1    00:00:00 /run/dojo/bin/ssh-entrypoint
hacker       107      90  0 18:17 pts/1    00:00:00 ps -ef
hacker@processes~listing-processes:~$ /challenge/7499-run-25632
Yahaha, you found me! Here is your flag:
pwn.college{83o3nFbf3SFAKLSp8Md4JghCljK.dhzM4QDL5cDOzIzW}

Killing processes

hacker@processes~killing-processes:~$ ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 18:21 ?        00:00:00 /sbin/docker-init -- /nix/var/nix/profiles/default/b
root           7       1  0 18:21 ?        00:00:00 /run/dojo/bin/sleep 6h
root          71       1  0 18:21 ?        00:00:00 su -c /challenge/.launcher hacker
hacker        73      71  0 18:21 ?        00:00:00 /challenge/dont_run
hacker        74      73  0 18:21 ?        00:00:00 sleep 6h
hacker        75       0  0 18:21 pts/1    00:00:00 /run/dojo/bin/ssh-entrypoint
hacker        76       0  0 18:21 pts/0    00:00:00 /run/dojo/bin/ssh-entrypoint
hacker       109      76  0 18:22 pts/0    00:00:00 ps -ef
hacker@processes~killing-processes:~$ kill 73
hacker@processes~killing-processes:~$ /challenge/run
Great job! Here is your payment:
pwn.college{4ms2vU4W1UpF6vPALTpoSmsYaYh.dJDN4QDL5cDOzIzW}

8 Permissions

Changing file ownership

We can change the ownership of files using chwon

chown [username] [file]

hacker@permissions~changing-file-ownership:~$ chown hacker /flag
hacker@permissions~changing-file-ownership:~$ cat /flag
pwn.college{QrtXdtN3_ov7AIpxdQxYUQPAyvH.dFTM2QDL5cDOzIzW}

Group and Files

Files have both an owning user and group

You can check what groups you are part of with the id command:

hacker@dojo:~$ id
uid=1000(hacker) gid=1000(hacker) groups=1000(hacker)
hacker@dojo:~$

Group ownership can be changed with the chgrp command

hacker@permissions~groups-and-files:~$ chgrp hacker /flag
hacker@permissions~groups-and-files:~$ cat /flag
pwn.college{cFIjHpcJh78GKT9fphqxbY_015f.dFzNyUDL5cDOzIzW}

Changing Permissions

Each character of the three represent permission for a different type:

r - user/group/other can read the file (or list the directory)
w - user/group/other can modify the files (or create/delete files in the directory)
x - user/group/other can execute the file as a program (or can enter the directory, e.g., using `cd`)
- - nothing 

9 Untangling Users

Becoming root with su

hacker@users~becoming-root-with-su:~$ su
Password: hack-the-planet
root@users~becoming-root-with-su:/home/hacker# cat /flag
pwn.college{MmHash-8tt6DGpWZuYADH4tYi7A.dVTN0UDL5cDOzIzW}

Other users with su

hacker@users~other-users-with-su:~$ su zardus
Password: 
zardus@users~other-users-with-su:/home/hacker$ /challenge/run
Congratulations, you have become Zardus! Here is your flag:
pwn.college{otxDMvJiFFTbUo_ZImCrfmfWAlg.dZTN0UDL5cDOzIzW}
zardus@users~other-users-with-su:/home/hacker$ 

cracking passwords

hacker@users~cracking-passwords:~$ john /challenge/shadow-leak 
Created directory: /home/hacker/.john
Loaded 1 password hash (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
aardvark         (zardus)
1g 0:00:00:20 100% 2/3 0.04854g/s 282.6p/s 282.6c/s 282.6C/s Johnson..buzz
Use the "--show" option to display all of the cracked passwords reliably
Session completed
hacker@users~cracking-passwords:~$ su zardus
Password: 
su: Authentication failure
hacker@users~cracking-passwords:~$ su zardus
Password: 
zardus@users~cracking-passwords:/home/hacker$ /challenge/run
Congratulations, you have become Zardus! Here is your flag:
pwn.college{QX9pbDPoIeQresk8-WSG5zrhwZ6.ddTN0UDL5cDOzIzW}

Using sudo

hacker@users~using-sudo:~$ sudo su