Isolated

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-04-17 | Status: Solved Techniques: alternative_file_reading, output_filter_bypass, restricted_shell_escape, short_command_crafting

Summary

Task: TCP service presents a restricted bash shell — commands prefixed with /cmd, 20-char limit, cat/head/tail removed, output containing 'error' blocked. Solution: use rev command to read files (bypasses both length and output filter), enumerate filesystem, find /fl4g.txt, reverse the reversed output to get the flag.

Isolated — hackerlab

Description

Ты отрезан от внешнего мира. Но, выход ведь есть всегда, правда?

English summary: a TCP service at 62.173.140.174:10980 presents a restricted bash interpreter. Commands must be prefixed with /cmd, limited to 20 characters, and several standard utilities are removed. The goal is to read a hidden flag file despite these restrictions.

Analysis

Service constraints

Connecting via nc 62.173.140.174 10980 reveals a custom shell with three layers of restriction: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Command prefix — all commands must start with /cmd (meta-commands /help and /exit also available)
2. Length limit — the command after /cmd must be ≤ 20 characters
3. Removed utilities — cat, head, tail, and other common file-reading tools are deleted by /root/removeUtils.sh at startup
4. Output filter — if command output contains the word error, the server replaces it with "Try harder!"

Reconnaissance

/cmd ls        → a  b  c  d.py  e  main.py  t  t.txt
/cmd id        → uid=1001(walter) gid=1001(walter) groups=1001(walter)
/cmd cat main.py → command not found
/cmd head main.py → command not found

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Listing /bin and /usr/bin showed hundreds of utilities still available — the removal was surgical, targeting only the obvious file-reading commands.

Output filter discovery

Several alternative file-reading commands (nl, sort, paste, fmt, tac) all returned "Try harder!" instead of actual content. By reading main.py source (via rev), the output filter was confirmed: the asyncio TCP server checks if command output contains the substring error and suppresses it.

Commands like nl and sort include error-related strings in their output (e.g., Python tracebacks or locale errors), triggering the filter. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Working bypass commands

Two commands passed all three restrictions:

Solution

Step 1 — Enumerate the filesystem

/cmd ls /

Output revealed /fl4g.txt in the root directory alongside standard Linux directories.

Step 2 — Read the flag file with rev

/cmd rev /fl4g.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Output:

}SKC1RT_XUNIL_GNIZ4MA{YBEDOC

Step 3 — Reverse the output

The rev command reverses each line character-by-character. Reversing the output back:

}SKC1RT_XUNIL_GNIZ4MA{YBEDOC  →  CODEBY{REDACTED}

Bonus — reading the server source

/cmd rev main.py

Revealed the full asyncio TCP server implementation, confirming:

• The /cmd prefix parsing logic
• The 20-character length check
• The error substring output filter
• The service runs as user walter (uid 1001)

/cmd rev e

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Revealed the startup script that runs removeUtils.sh to delete standard file-reading utilities before launching the service. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍