OOO archive --- DEF CON CTF [ login ]

dc2020q - ooobash reversing

by reyammer

This was a jeopardy challenge, part of dc2020q. (CTFtime)

Points: 120
Was solved by: 58 teams
PCAPs: download

You may spawn the server:

On your laptop
  • Install docker
  • docker pull archiveooo/pub:ooobash (docker-saved download)
  • docker run -d --name ooobash archiveooo/pub:ooobash
  • Local IP: docker inspect ooobash -f '{{ .NetworkSettings.Networks.bridge.IPAddress }}'
  • Connect to that IP:5000 — Remember to docker rm -f when done.
On your laptop (full source)
  • Install docker and pip install PyYAML coloredlogs
  • git clone
  • cd ooobash
  • ./spawner --log-level=INFO
  • Connect to the ip:port displayed
Hosted by OOO Right now we're asking players to login first.


Execute 'getflag' to get the flag.


None yet :(
If you wish, you can contribute some.

There's an author-recommended writeup.

Further (spoilery) pointers

An easier, unintended solution.This challenge was actually created for the 2018 quals... fast forward to 2019, something happened in the bash world that opened an easy unintended solution.


Spoilers ahead! Code for this challenge is publicly available.