Blood Bash 3

Challenge:

There's a flag on this system that we're having difficulty with. Unlike the previous flags, we can't seem to find a file with this flag in it. Perhaps the flag isn't stored in a traditional file?

Username: bl0ody_mary
Password: d34df4c3

bloodbash.deadface.io:22

Solution:

This challenge took a bit of hunting around looking for "non-traditional" files. Eventually, one of our steps was to list any listening sockets and we identified a service listening on port 43526/UDP:

$ netstat -untl

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 127.0.0.1:43526         0.0.0.0:*                          

Using netcat to connect to the service and simply hitting the return key produced the flag:

$ nc -u 127.0.0.1 43526

flag{open_port(al)s}