picoCTF Obedient Cat Walk-through

 Hello Everyone!

Today I'm gonna give a quick walk-through of the Obedient Cat challenge offered by picoCTF.  This will most likely be the first challenge you'll be presented with after signing up for picoCTF and it is very beginner friendly and a fun little way to start getting your feet wet with the world of capture the flag! So without further ado let's jump right into it...

So to start off when you create an account on picoCTF you can go to the practice section of the website and you should see a bunch of challenges like below. 

 

 

 

 

 

 If you are doing CTF challenges for the first time you can set the Category Filters to General Skills and this will be a good starting point. One of the first challenges you'll see will be Obedient Cat. 

Now on the picoCTF challenges you two options you can either deploy the webshell provided and use that as your terminal interface or you can go ahead and use your machine's actual terminal. For this challenge it's really up to you but for the purposes of this demonstration I'll be walking you through using the terminal on your actual machine. 

 

Okay, let's go ahead and select the Obedient Cat challenge and see what we're dealing with. 

 

 So here we can see we have the prompt "This file has a flag in plain sight (aka "in-the-clear") with a link to download the flag. We also have three hints on the right. Let's go ahead and take a look at the hints before we download the flag.  

 

For this first hint, it is pretty self explanatory. Just keep in mind if they are giving any hints about entering a command in our Terminal, the command will start after the '$' symbol so everything after the dollar sign will be what you type into you Terminal.
 

For this second hint, this is going to be applicable if you deployed the webshell to use as your terminal interface. If you did deploy the webshell, you won't need to download the file they provided for this challenge you can simply enter the command 'wget' followed by the link provided. Simply put, 'wget' (web get) is a command you can use to retrieve files from webpages to your local machine or in this case the webshell you deployed. If you are going to be using the webshell for every challenge then 'wget' is going to be your best friend. If you are using the terminal on your Linux system like me you can go ahead and disregard this hint but it can be useful for future challenges if you choose to use the webshell in the future.

Finally, for the last hint it gives us '$ man cat'. If you'll remember from the first hint anything after '$' is going to be a command we can use in our terminal so let's go ahead and input this into our terminal and see what we get..

Looks like we get the manual page for the 'cat' command. If you haven't already guessed it...we are going to be exploring the 'cat' command with this challenge. Usually in Linux, 'man' is going to be referring to 'manual' and with the 'man cat' command we are basically asking to be shown the manual for 'cat'. Go ahead and read up on it in the man page but to put it simply 'cat' stands for 'concatenate' and is a command mainly used to output the contents of a file however there are other things you can do with the command such as creating and appending files however I will let you read up on the other uses of 'cat' on your own time. For this CTF we will be using the functionality to output the contents of a file using 'cat'. 

Now that we have looked through all the hints and read through the manual page for the 'cat' command lets go ahead and download the file. After downloading the file you could technically just open the file to find the flag...but whats the fun in that. Rather let's go ahead use our terminal to finally use the 'cat' command we've read so much about. 

 

Once you open your terminal let's go ahead and find out where the flag was downloaded to by using the 'ls' command. This command will list the files located in a directory. I'm going to guess mine was saved to (you guessed it) the Downloads directory so I'll go ahead and 'ls' that directory. 

After listing the files located in my Downloads directory we can see the file 'flag' is located here. Next let's go ahead and 'cd' over to the Downloads directory. The 'cd' command will allow us to 'change directory' so we are in the Downloads directory. Also in Linux it is important to remember that everything is case sensitive. Meaning if you input the command 'cd downloads' you will mostly likely get an error because it won't be able to locate a directory named 'downloads' so make sure you are inputting 'cd Downloads'.

  

Above you can see where I used the 'cd' command to get into the Downloads directory, then I used the 'ls' command to show the files within this directory. From here we can see the flag file that we downloaded earlier. We are one command away from securing the flag.. Let's go ahead and 'cat' this file.

We did it! You can see the output of the 'cat' command was the flag: 

picoCTF{s4n1ty_v3r1f13d_28e8376d}

It's important noting that in picoCTF, all the flags that we find will almost always be in the same format: picoCTF {insert flag here}. So keep that in mind as you are progressing through these CTF challenges. 

And that pretty much wraps up our first walk-through on picoCTF! Hopefully you learned a little bit about how CTF works and some basic Linux commands as well. As you progress through these challenges they will become increasingly difficult so hacking one of these challenges will not always be as easy as inputting a simple command into out terminal, however, it will be a great way to practice the things you learn in a practical setting. 

Thank you for reading along and keep an eye out for more walk-throughs here in the near future!

As always,

Happy Hacking!