ctf-writeups

Day 03

Challenge script:

#!/bin/sh

set -eu

GIFT="$(cat /flag)"
rm /flag

touch /stocking

sleeping_nice() {
    ps ao ni,comm --no-headers \
        | awk '$1 > 0' \
        | grep -q sleep
}

# Only when children sleep sweetly and nice does Santa begin his flight
until sleeping_nice; do
    sleep 0.1
done

chmod 400 /stocking
printf "%s" "$GIFT" > /stocking

We can handle sleeping_nice check by running a sleep command using nice:

nice sleep 100

But we need to read the flag out, which is chmod 400 later. However, the file remains the same. If we open it early and keep the file handle, we can read its content regardles of its permission:

ubuntu@2025~day-03:~$ tail -f /stocking
pwn.college{EeIeWi4nVDHtOxoSiYBvXZZWKzg.0FN4gTMywyM5EzN0EzW}^C

Steps:

1. run tail -f /stocking
2. run nice sleep 100 in another terminal
3. find flag from the output of tail