arrow-left

All pages
gitbookPowered by GitBook
1 of 3

Loading...

Loading...

Loading...

Misc

Tea-mix

The name hinted towards tmux, which was confirmed by session files for tmux in /tmp; including /tmp/tmux-0/tea_mix (root's session) We have permission toy read the socket file, meaning we can attach to the tmux session.

export TERM=xterm
set tty rows/cols to your own terminal
tmux -S /tmp/tmux-0/tea_mix
root shell
cat /root/flag.txt

hashtag
Flag: flag{oooohhhh_tea_mix_sounds_like_tmux_i_get_it}

Swipe

Download 'swipe', it's a vim swap file

So create /tmp/swipe folder, move the swap to /tmp/swipe/.flag.png.swp

vim flag.png , will offer to recover file

inside is a png

extract png with dd if=flag.png of=flag2.png bs=1 skip=889

scan qr code in it

boom

hashtag
Flag:flag{swipe_right_on_vim_swap_soisoisoisoisoi}