> For the complete documentation index, see [llms.txt](https://nickbhe.gitbook.io/shikata-ga-nai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nickbhe.gitbook.io/shikata-ga-nai/pwnable.kr/20-blukat.md).

# 20 - blukat

## The Challenge

Sometimes, pwnable is strange... hint: if this challenge is hard, you are a skilled player.

ssh <blukat@pwnable.kr> -p2222 (pw: guest)

## The Solution

This challenge is about paying attention and questioning reality itself.

At first glance everything is as usual:

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MIsQGdAcbNR61lUSal2%2F-MItRWD05Bhfh-5JJOAw%2Fimage.png?alt=media\&token=4614afd0-417e-4dd8-ba7e-ee25703ae9e1)

Only members of `blukat_pwn` can access the password which we need to get the flag. As we started analyzing the challenge we had some opportunities to figure out something was wrong. For example:

* How did we just copy the password file to my local machine?
* Why `fgets` stores in memory *"cat: password: Permission denied"* ?

Take a close look at blukat's group permissions:

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MIsQGdAcbNR61lUSal2%2F-MItQPZGDArtgh0-7K2o%2Fimage.png?alt=media\&token=f185dfcf-95e4-4cd9-bdab-28fccfd977cb)

We are part of the `blukat_pwn` group, and that permission denied string is the password!

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MIsQGdAcbNR61lUSal2%2F-MItUvCJl52iTnbMTPU7%2Fimage.png?alt=media\&token=7e898633-7942-4b47-be9a-0fb06b3422c7)

Use this to grab the flag and get this over with.