 Hey everyone, welcome back to another YouTube video for PicoCTF. My name is John Hammond and let's get started. This challenge is called You Can't See Me for 200 points in the general skills category. It says reading transmission. You can't see me transmission ended. Maybe something interesting lies in this location. So it's on the file server, right? It's on the shell server. So let's go ahead and connect to it. I'm just going to run my ssh.sh script. Go ahead and type in my password so I can log in. And let's change directory to that location. If I ls, there's nothing in the directory. So I figured like, well, let's check out hidden files. Let's ls tag a. And you can see there is a period for the current directory, two periods for the parent directory, just as you always see an ls tag a. And those are noted in blue with ls colors because they're a folder, right? But we have an interesting thing where we have this other period file. So if I want to try and cat it out, I wouldn't be able to like cat period. It says, well, it's a directory. That doesn't work. Can I try and cat this directory here? No, it still considers it a directory. So weirdness, right? I can cat all. No, there's nothing here. Cat start.all or period.all. It, that works okay for me. That will be able to interpret stuff that is starting with a period. Another thing that I tried was like greptack r with period. Period doesn't mean the file that we're looking for, but it means the pattern that we're looking for. And I'm using regular expressions so it'll match anything. And tack r means recursive. So all the files that you see, and that will receive it here. Note that it's a period and a couple of spaces. So if I wanted to run like cat period backslash backslash, then it will read it out because I needed a backslash space and backslash space to actually like interpret those spaces in there. I could cat dot space space and that would read it out. And you wouldn't need the period in the start because the space will work. But again, it has to be in quotes to denote that. So interesting thing, right? Anyway, we got the flag. Excuse me. I'm sorry. That challenge is complete. And we're good to move on. Mark that challenge is complete. Let's go ahead and paste it. Sweet. Next challenge is called buttons. It says there's a website running at this location. Try to see if you can push their buttons. So we have buttons. It says push me. I'm your only hope. It says you did it. Try the next button. Button two. It says boom. Oh, whoa, I'm getting rigged roll. Holy crap. I can't show that. I'm going to get a copyright strike. It says form disabled. This incident has been logged and reported to DevNol. So let's check out this page here. It says form action button 2.php. It looks like there isn't anything here, but it is trying to post to button 2.php. So let's see if we can actually just make that request, right? We can probably just take button 2.php, take that URL, and run that curl command with it, make directory buttons, city buttons. Let's run curl and then tack x to specify the method, post, and let's use the URL here. Awesome. It just pumps out the flag. Cool. Let's go and reverse it so I can just cut tack d, get the very last field of spaces, and then reverse that back. We don't need all that output from curl. So that works just fine as our get flag script. Bin bash. Mark it as executable. Redirect that to a flag.txt file. Sweet. Copy to our clipboard. Clip, not clear up, and we can submit that. So awesome. Not too hard, right? Those are interesting challenges, kind of a cool trick, an interesting thing, but just kind of being observant and really looking at what you have in front of you and be able to kind of piece it together and have that intuition to know what to do with it. So you could do this with curl. You could have done this with Python requests. You could do this with probably like developer tools if you wanted to, fire up some F12 in your browser. But hey, hope you guys enjoyed. Hope you like watching these. Quick shout out to the people that support me on Patreon. Thank you guys so much. I say it all the time, never enough. One dollar a month on Patreon will give you a special shout out just like this. Five dollars or more on Patreon will give you early access to everything that I release on YouTube before it goes live. If you did like this video, please do like, comment, and subscribe. Join our Discord server, link in the description. It's a cool community full of CTF players, programmers, and hackers. We're always going to be tackling some capital flag competitions. You can hang out with me and other awesome people all about learning and all about being in the scene. So thanks for watching guys. Hope to see you in the next video. Hope to see you on Patreon. Love ya, bye.