Hide and Seek Walkthrough

Challenge Statement#

Solution#

Firstly, we can assume ROOT since we can do sudo su.

➜ The First Clue - “Time is on my side, always running like clockwork.”, suggests something related to cronjobs in Linux.
We can check all the current cron jobs using crontab -l.

We can decode this to find the 1st part of the flag.

➜ The Second Clue - “A secret handshake gets me in every time.”, suggests something related to the SSH.
We can check the .ssh folder on all of our accounts.

We find a strange string after the sha2 key. Let’s try to decode it.

➜ The Third Clue - “Whenever you set the stage, I make my entrance.”, refers to something that runs when a user logs in.
Let’s check the .bashrc files.

Decoding it we can get our 3rd part of the flag.

➜ The Fourth Clue - “I run with the big dogs, booting up alongside the system.”, suggests some service which runs when the system is booted. Let’s check for the any suspicious services -

systemctl list-unit-file --type=service | grep enabled

We find this file called cipher.service, let’s investigate further.

Decoding this string, we get our 4th flag.

➜ The Fifth Clue - “I love welcome messages.”, refers to the message of the day (MOTD), which is sent when the user logs in.
Checking out the /etc/update-motd.d folder, we can find this string.

Decoding it, we get out final flag.

➜ Combining all the flags, we can submit our complete flag.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.