BashCraft

Level

medium

Type

Forensics

Sometimes files appear identical, yet they hold subtle differences beneath the surface. Sometimes what we observe seems one thing, but in reality, it tells a different story. It’s a simple question, but uncovering the answer takes running multiple commands. So, as always — what’s the flag?

Unzip home.zip and Navigate to Desktop folder, Changes directory to Desktop.

unzip home.zip

ls home 
KaliSim

cd home/KaliSim/

ls     
Desktop    Downloads  Pictures  Templates
Documents  Music      Public    Videos

cd Desktop

List all files, including hidden ones, Lists all files and directories with details. a shows hidden files, l gives long listing.

ls -al

View contents of the hidden file, Displays the contents of .hidd3n.txt, which contains a clue about a saved hash.

cat .hidd3n.txt

SectionOne: You find the initial section to begin the search? As you can see, I have many files, but one of them is very important. I forgot its name and all details. I only remember that I once saved its hash value somewhere on my device, but I forgot where. Please help me retrieve the content of that file.

Move back one directory, Navigates up one level from the current directory.

cd ../

List sizes of all files and directories recursively, Recursively lists all files and folders with their sizes.

ls -alR

Find files greater than 100 bytes, Finds all files (type f) larger than 100 bytes (+100c) in current and subdirectories.

find . -type f -size +100c

./KaliSim/Desktop/.hidd3n.txt
./KaliSim/Downloads/pxpJNzpW/Ebb4Wmu8.txt
./KaliSim/.zsh_history

Read the content of the identified .txt file, Displays the content, which appears to be a SHA-256 hash.

cat Downloads/pxpJNzpW/Ebb4Wmu8.txt

(Hash string noted) 29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db is likely a SHA-256 hash, 64 hex characters (32 bytes).
Search for a file matching the SHA-256 hash, Computes sha256sum of all files and searches for a match with grep.

find . -type f -exec sha256sum {} + | grep 29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db

29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db  ./Music/zGFJYNpB/2jpKQMfq.txt

View the contents of the matching file, Displays encoded content that looks like Base64.

cat Music/zGFJYNpB/2jpKQMfq.txt

WVVDVEZ7TDBuR19UM3h0X0wwMDAwbkdfTDBuR19UM3h0X0wwbkdfIFNlY3Rpb25Ud286IFNvbWV0aW1lcywgc2l6ZSBtYXR0ZXJz

Decode the Base64 string, Decodes Base64 content to reveal the first part of the flag.

echo "WVVDVEZ7TDBuR19UM3h0X0wwMDAwbkdfTDBuR19UM3h0X0wwbkdfIFNlY3Rpb25Ud286IFNvbWV0aW1lcywgc2l6ZSBtYXR0ZXJz" | base64 -d

YUCTF{L0nG_T3xt_L0000nG_L0nG_T3xt_L0nG_ SectionTwo: Sometimes, size matters

Check terminal command history, Opens .zsh_history in Sublime Text to review previous commands.

subl .zsh_history

As see we have lot's of commands but if we go down so much we can see we have more content, so we will combine then in one section:

We have brainfuck code so we will decode it by going to:
dCode_fr Brainfuck
This is the result of the decode:

I might be hard to notice sometimes, so here a end: Hid33n_#T3xt_is_#hidd3n}

We can now combine the flag and get it
Flag: YUCTF{L0nG_T3xt_L0000nG_L0nG_T3xt_L0nG_Hid33n_#T3xt_is_#hidd3n}

drwxrwxr-x 10 semopurple semopurple 4096 May 15 20:55 . drwxrwxr-x 3 semopurple semopurple 4096 May 15 21:19 .. drwxrwxr-x 4 semopurple semopurple 4096 May 15 20:25 Desktop drwxrwxr-x 5 semopurple semopurple 4096 May 15 20:03 Documents drwxrwxr-x 5 semopurple semopurple 4096 May 15 20:03 Downloads drwxrwxr-x 4 semopurple semopurple 4096 May 15 20:03 Music drwxrwxr-x 5 semopurple semopurple 4096 May 15 20:03 Pictures drwxrwxr-x 3 semopurple semopurple 4096 May 15 20:03 Public drwxrwxr-x 3 semopurple semopurple 4096 May 15 20:03 Templates drwxrwxr-x 4 semopurple semopurple 4096 May 15 20:03 Videos -rw-rw-r-- 1 semopurple semopurple 41885 May 15 21:10 .zsh_history

SectionOne: You find the initial section to begin the search? As you can see, I have many files, but one of them is very important. I forgot its name and all details. I only remember that I once saved its hash value somewhere on my device, but I forgot where. Please help me retrieve the content of that file.

... -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 4M8GBIyU.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 4mEzc8Tc.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 53IjVsFm.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 5eEaLYrd.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 6357P0uJ.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 6I1EgxJJ.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 7UuVQtxU.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 8PvBGxdl.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 AIgzhrDX.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 bbbJtW0x.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 biUDBAtj.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 BOFyO4XF.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 CCYVYRHv.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 Cllr3Dz9.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 Ctefnj6M.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 dZLjxEBu.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 eF2F6RWU.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 EMT1wm2A.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 eXKHnaXJ.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 fIOFvAOV.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 FrSpnZ5R.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 Gbs1wOHR.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 gpMUTSCW.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 gzQd3nNr.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 H51p0pvG.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 ha1TcvaK.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 hewLuMeg.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 I0MKaHql.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 IGclUD08.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 KI2XAb0e.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 L5zvQz3R.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 LPWUiy0V.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 MkORj1oT.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 mTxuRDzc.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 nNrW8Ihe.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 oFBOkOn1.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 pR7Oe9lu.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 Q6xQKUKE.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 qE3SICqy.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 Rg5dHWKk.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 tBlOhV6N.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 U12jIeZI.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 UvTi3Yz0.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 V1l1V3p7.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 VNrNBGfh.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 vsj24KZB.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 wjMVaC4h.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 WP8Oy3Wa.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 WpCVTagg.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 wx1KY1ZS.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 X3ply31h.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 x7R88IFV.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 xwjGghY9.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 YjcoT5rM.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 YYOB54iU.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 yYqVDWZV.txt -rw-rw-r-- 1 semopurple semopurple 100 May 15 20:03 ZaVZWXzu.txt

... zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db} zzlTEcOTXZuvIWUmuuBLNW4NwBrJLWCaw3sYNDeBOq07T9hEpaYNeb0DLrTG1wFJlXDsF21QtX{29a93a0b0684d3eeeb85942d29f0fa6ec84456b689329391fbe66c7774f726db}

ls cd ../ cd Videos mkdir TestFolder cd ../../ touch TestFile.txt pwd rm -rf OldFolder cp TestFile.txt BackupFile.txt mv BackupFile.txt Archive/ cat TestFile.txt echo "Hello World" > Greetings.txt head -n 5 TestFile.txt tail -n 10 Logs.log mkdir Projects cd Projects touch README.md nano README.md chmod 755 Scripts ./Scripts/run.sh find . -name "*.log" grep "error" system.log tar -czvf archive.tar.gz Documents/ unzip files.zip -d extracted/ df -h free -m ps aux | grep ssh kill -9 1234 history | tail -20 du -sh * ln -s /usr/bin/python3 python curl http://example.com wget https://example.com/file.zip chmod +x script.sh ./script.sh date uptime whoami env export PATH=$PATH:/opt/custom/bin mount /dev/sdb1 /mnt/usb umount /mnt/usb systemctl status apache2 journalctl -xe ...

... -[------->+<]>. -[->++++<]>.+[- ---->+<]>.----. --.+.++++++++++ ++.[---->+<]>++ +.[->+++<]>++.+ ++.--[--->+<]>- .-[--->++<]>--. -------.--[---> +<]>---.------- -------.-[--->+ <]>-.---[->++++ <]>.-----.[---> +<]>-----.+[--- ... -->+<]>+.+.++++ +.-----------.- -----.++.--[--- >+<]>-.---[->++ ++<]>-.----.--. --------.[--->+ <]>---.-------- ---.++++.------ --.[--->+<]>--- -.-[++>---<]>+. ------------.-- ... -[->++++<]>-.-- --.[--->+<]>--- --.-[--->++<]>- -.---.+++++++++ ++++.---------- ---.-[---->+<]>. --[->+++++<]>.+[ ---->+<]>+++.[-> +++<]>+.-[->+++< ]>.+[->+++<]>++. +++++++++.------ ----.[----->+++< ]>--.[-->+<]>+++ ... .++++[->++<]>.-- [-->+++<]>.----- .[-->+<]>+..++++ [->++<]>.------- --------.++[->++ +<]>.>-[--->+<]> -.>-[----->+<]>. +[--->++<]>.---- .+[->+++<]>.++++ ++++++.+++++++++ +.++[->+++<]>.++ [->+++<]>.[->+++ <]>-.+.-----..[- ->+<]>+.++++[->+ +<]>.[--->+<]>++ +.

echo "-[------->+<]>.-[->++++<]>.+[----->+<]>.----.--.+.++++++++++++.[---->+<]>+++.[->+++<]>++.+++.--[--->+<]>-.-[--->++<]>--.-------.--[--->+<]>---.--------------.-[--->+<]>-.---[->++++<]>.-----.[--->+<]>-----.+[----->+<]>+.+.+++++.-----------.------.++.--[--->+<]>-.---[->++++<]>-.----.--.--------.[--->+<]>---.-----------.++++.--------.[--->+<]>----.-[++>---<]>+.------------.---[->++++<]>-.----.[--->+<]>-----.-[--->++<]>--.---.+++++++++ ++++.-------------.-[---->+<]>.--[->+++++<]>.+[---->+<]>+++.[->+++<]>+.-[->+++<]>.+[->+++<]>++.+++++++++.----------.[----->+++<]>--.[-->+<]>+++.++++[->++<]>.--[-->+++<]>.-----.[-->+<]>+..++++[->++<]>.---------------.++[->+++<]>.>-[--->+<]>-.>-[----->+<]>.+[--->++<]>.----.+[->+++<]>.++++++++++.++++++++++.++[->+++<]>.++[->+++<]>.[->+++<]>-.+.-----..[-->+<]>+.++++[->++<]>.[--->+<]>+++."