Post cover image
CyLab Security Academy screenshot taken by author

August 27, 2026

Writeup for CyLab/picoCTF challenge “Super SSH”

Learn how CyLab’s “Super SSH” challenge introduces the ssh command, using a username, password, and custom port to connect to a remote…

By Walter Moar

7 min read

Learn how CyLab's "Super SSH" challenge introduces the ssh command, using a username, password, and custom port to connect to a remote server securely.

This writeup gives a step-by-step explanation of the CyLab Security Academy challenge "Super SSH". The best learning experience comes from working through the challenge alone, but read on if you're stuck or are curious about other approaches.

CyLab Security Academy (previously called "picoCTF") uses Capture The Flag (CTF) security challenges to teach security fundamentals. The challenges cover various security categories (web exploitation, cryptography, forensics, etc) but they all have the common goal of finding a flag in the format picoCTF{unique-text-string-here}. Some challenges are easy and others deviously difficult, but they are all great for learning security skills.

About the "Super SSH" Challenge

This is a beginner challenge, and it can be solved by anyone with a few technical skills that will be explained in the writeup.

  • Name: Super SSH
  • Category: General Skills
  • Difficulty: Easy
  • Description: Using a Secure Shell (SSH) is going to be pretty important.
  • Hint 1: https://linux.die.net/man/1/ssh
  • Hint 2: You can try logging in 'as' someone with @titan.picoctf.net
  • Hint 3: How could you specify the port?
  • Hint 4: Remember, passwords are hidden when typed into the shell

This challenge looks like it's going to be an introduction to Secure Shell (SSH).

Background Knowledge

To solve this challenge it helps to understand:

If the above are new concepts, it's good to first get a solid understanding by reading the articles. The walkthrough below covers these topics but it does not go into detail.

Solution Walkthrough

It's time to begin the challenge, which involves starting a new instance of a server:

None

The Launch Instance button starts the server and produces a bunch of new information:

None
  1. The description now includes a username (ctf-player), a host name (titan.picoctf.net), and a port (49989). To avoid conflicts when many users run the challenge at the same time, each instance has a random numbered port
  2. The description also contains the password for the ctf-player user: 84b12bae. Note that this password will probably change.
  3. There is a link to the WebShell, but it is also available in the "Workspace" (more on that below)
  4. There is also a broken link to the picoCTF Primer article on the shell. The new location for CyLab is https://primer.cylabacademy.org/#_the_shell
  5. The server only runs for 30 minutes, and there is 29:55 left on the clock. It's important to remember that if the server suddenly stops working then the instance needs to be restarted

The Workspace and WebShell

Since not everyone has a Linux computer at home, CyLab provides the WebShell, which is a browser-based terminal using the Ubuntu flavour of Linux. The WebShell is accessed through the Open in Workspace button at the bottom:

None

Once the Workspace is open, the "Terminal" tab accesses the Linux terminal (or "shell"):

None

Using Secure Shell (SSH)

The article "CTF Basics: Understanding Secure Shell (SSH)" explains ssh in detail. However, any time a new command is mentioned in a challenge it can be researched using its man page. Typing man ssh in the CyLab WebShell gives:

None

There is a lot more information below this screenshot, but this top section gives a good summary of the command. The DESCRIPTION section basically says that ssh is used to create a secure (encrypted) network connection from one computer port to another computer port.

Commands like this have an overwhelming number of options that control how the command works. At the beginning it isn't necessary to read the entire manual page, or to learn all the options. More options can be learned later for more advanced use of the command.

The SYNOPSIS section says that the only mandatory parameter to the command is the destination. This seems straightforward, but what exactly is the format of the destination? In the second paragraph of the DESCRIPTION section it says that one way to specify the destination is [user@]hostname. Note that the user is optional, and if it is ntot specified then the current username is used. In this challenge, though, the description says that the user is ctf-player, so the destination will be ctf-player@titan.picoctf.net.

Forgetting to specify the port number can be a common mistake when using ssh. It's not only common, but it's frustratingly hard to figure out the problem. This is because SSH servers by default run on port 22, but for these security challenges each new instance gets a custom port number like 49989. So if the port number is not specified when using the ssh command, then the command by default connects to the server running on port 22! It's unlikely that ctf-player with password 84b12bae also exists on the port 22 instance of the SSH server, so the login will always fail. It's really important to remember Hint #3:

How could you specify the port?

Looking back at the SYNOPSIS section of the manual page, there is an option [-p port]. So putting everything together, it looks like the command will be ssh -p 49989 ctf-player@titan.picoctf.net:

None

This is progress, and the expanded challenge description warns about this:

If asked, accept the fingerprint with yes.

So the thing to do here is type yes and hit enter (more on this later in the "Alternative Solution" section, as it's an important security mechanism):

None

Now the command is asking for the user's password. It's important to remember Hint #4:

Remember, passwords are hidden when typed into the shell

This is important as it prevents someone from "shoulder surfing" and seeing the password when it gets typed in. This one tends to catch people who are using the command for the first time, as they don't realize that the password is indeed being entered. So type (or carefully paste) the password and hit the enter key:

None

Hooray, there is the flag, although the contents are intentionally hidden. Publishing flags spoils the learning experience, as working through the steps is the best way to learn.

Alternative Solution

The manual page for ssh describes another way to specify the destination parameter as a URI: ssh://[user@]hostname[:port]. The user is optional, and if not specified then the current username is used. Similarly, the port is optional, and if not specified then the default port 22 is used. For this challenge, both of the parameters need to be given, so the destination URI is ssh://ctf-player@titan.picoctf.net:49989:

None

This works, but there is one really important subtlety here. On the first run of ssh there was a warning:

The authenticity of host '[titan.picoctf.net]:49989 ([3.139.174.234]:49989)' can't be established.
ED25519 key fingerprint is SHA256:4S9EbTSSRZm32I+cdM5TyzthpQryv5kudRP9PIKT7XQ.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is a key security mechanism of SSH. When the user connects to an unknown server for the first time, this warning is given. If the user chooses "yes" then the command remembers the server:

waltermoar-academy@webshell:~$ cat ~/.ssh/known_hosts
|1|aed7qd0QIK0VMI+zYCArX+npLV8=|fCwLLUoeZP1HZbtF12Vt98r7T+A= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDEJp070pdu6ZIuPLiZMPt6yqIBomGJ4Xp2s6YBxe3bf

Once the server's information is stored, all future connections to the same server do not produce the warning.

Consider the case where someone is using SSH every day for work. This warning is given the first time connecting to a new server, but after that (since "yes" was chosen) the command remembers the server. If someone was to sneakily replace the server, or manipulate the networking to go to a different server, then suddenly it would warn that the server was unknown. This should be enough to clue in the user to definitely not type in their password to this imposter server!

Learned in this Challenge

  • SSH (Secure Shell) creates an encrypted network connection between two computers, allowing secure remote access to a server
  • The basic SSH syntax is ssh user@hostname, and the -p flag specifies a non-default port: ssh -p 49989 ctf-player@titan.picoctf.net
  • SSH servers run on port 22 by default, so forgetting -p when a custom port is required will silently connect to the wrong port and fail to log in
  • An alternative destination format is a URI: ssh://user@hostname:port
  • When connecting to a server for the first time, SSH warns that the server's identity is unknown and asks whether to trust it. Typing yes saves the server's fingerprint to ~/.ssh/known_hosts
  • Passwords are hidden when typed in the shell, which prevents shoulder surfing but can confuse users who think nothing is being entered
  • The known_hosts file remembers trusted servers, and SSH will warn if a previously trusted server's fingerprint changes, which can indicate a man-in-the-middle attack

Beyond the Challenge

The focus of this challenge was connecting to a remote server using SSH with a username, password, and custom port, but there are other directions worth exploring:

  • SSH key pairs are a more secure alternative to passwords for authentication. A private key stays on the client and a public key is placed on the server, so no password ever travels over the network
  • scp (secure copy) uses SSH to transfer files between computers, and follows a similar syntax to ssh
  • The related "what's a net cat" challenge covers basic TCP connections without encryption and is another important networking command

Want to learn more about security weaknesses? I'm working through the CWE list and doing writeups for security challenges. Follow along for more articles like this one.