[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_172":173,"_174":167},"routes/_root/_root",{"_169":-7,"_41":170,"_139":-7,"_171":-7},"routes/_root.challenges",{"_37":165,"_166":167,"_168":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_68":69,"_70":71,"_72":73},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","cowsay jail","canonicalName","cowsay-jail",{"_28":62,"_30":63,"_32":64,"_34":16,"_35":16,"_36":16,"_37":38,"_39":65,"_41":42,"_43":16,"_44":66},{"_28":56,"_30":57,"_32":58,"_34":16,"_35":16,"_36":16,"_37":38,"_39":59,"_41":42,"_43":16,"_44":60},{"_28":49,"_30":50,"_32":51,"_34":16,"_35":16,"_36":16,"_37":38,"_39":52,"_41":42,"_43":16,"_44":53},{"_28":29,"_30":31,"_32":33,"_34":16,"_35":16,"_36":16,"_37":38,"_39":40,"_41":42,"_43":16,"_44":45},"author",{"_20":46,"_47":48},"writeupElementId","8f016bda","writeupId","8f016bda-4daf-4dd6-bc2d-1462b1455c3b","canEdit","canLike","likedByViewer","title","Writeup for cowsay jail","url","https://github.com/tadanobutubutu/cowsay-jail-solve/blob/main/README.md","language","ja","isOfficial","createdAt",["D",1792053760535],"tadanobutubutu","gravatarHash","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":54,"_47":55},"d51aa1ac","d51aa1ac-ca1e-441e-827a-c1bc2975757f","https://blog.sl91994.com/posts/cowsay_jail/",["D",1792012760673],"nirvana","19230d0bc032c2027fc6fb6f83981b557ebf2f2e8a0144244413b987d4eb583a",{"_20":61,"_47":-5},"040b6c04","040b6c04-8ece-4943-8f68-575e7aacb8b7","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202610/d13-14_cowsay_jail",["D",1792009040350],"baumroll1234",{"_20":67,"_47":-5},"0b37e278","0b37e278-5e8b-405e-abad-6c1b2ad9c9d7","https://github.com/Not-Runad/AlpacaHack_Writeups/blob/main/writeups/cowsay_jail.md",["D",1791995031472],"lumma","challenge",{"_20":21,"_22":23,"_77":78,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92,"_93":16,"_94":-7,"_95":96,"_97":-7,"_98":-7,"_36":16,"_99":100,"_101":102,"_103":16,"_104":-7,"_105":16,"_106":-7,"_107":-7,"_108":109,"_110":-7,"_111":-7,"_112":-7,"_113":114,"_115":16,"_116":-7,"_117":114,"_35":114,"_118":16,"_119":-7,"_120":121,"_122":123,"_124":125,"_126":127},"availablePages",[74,75,76],"canonicalUrl","https://alpacahack.com/challenges/cowsay-jail","Description","Solves","Writeups","solves",66,"difficulty",40,"flagFormat","Alpaca{...}","categories",[162],"attachments",[158],"remote",{"_155":156,"_157":114},"description","The `cowsay` command is a great command for emphasizing a text!\n\n🦙 < flag is at `/flag.txt`.\n\n

Beginner Hint: Approach to Solving the Challenge

\n\n- It seems difficult to read `/flag.txt` using only the `cowsay` command. In this challenge, the `shell=True` argument is specified for `subprocess.run`. Let's consider how we leverage that to execute other commands using characters not included in the `deny_list`.\n- Even if we can execute other commands, passing arguments is difficult because `deny_list` contains spaces. Let's try to find a way to represent spaces using characters not included in `deny_list`.\n\n

\n","descriptionJa","`cowsay`コマンドは文字列を強調できる素敵なコマンドです！\n\n🦙 < フラグは `/flag.txt` にあるパカ\n\n

初心者向けヒント: この問題へのアプローチ

\n\n- `cowsay`コマンドだけでは`/flag.txt`を読み込むことは難しそうです。今回の問題では`subprocess.run`に`shell=True`引数が指定されています。このことを利用して、`deny_list`に含まれない文字で他のコマンドを実行できるか考えてみましょう。\n- 他のコマンドを実行できるようになっても、`deny_list`にスペースが含まれているため、引数を渡しづらい点があります。`deny_list`には含まれない文字を使ってスペースを表現する方法を探してみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[152],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[141,142,143,144],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","previewCtfCanonicalForAction","canCreateInstance","showcaseMode","dailyProgramCanonicalForAction","reviewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_128":129,"_108":109,"_130":131,"_132":133,"_134":135,"_136":137},"nextDailyCanonical","decreasing","httpsProxyHostname","cowsay-jail.chal.alp4ca.com","program",{"_22":121,"_20":138,"_139":140},"scheduledDate",["D",1791817200000],"releaseAt",["D",1791817200000],"status","PUBLISHED","plannedTopic","Jail","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":137,"_22":151},{"_20":149,"_22":150},{"_20":147,"_22":148},{"_20":145,"_22":146},"Cowsay","cowsay","Command Injection","command-injection","Shell","shell","jail",{"_20":153,"_47":154},"tan90909090","b798cd37a3b189532822b9d09f02f5b994cf23f40bb5edd06829140c9528af5b","instances",[],"canSpawn",{"_159":160,"_39":161},"fileName","cowsay-jail.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/1747da6f-50d1-41b0-b0bb-ebbe4001df8e/cowsay-jail.tar.gz",{"_20":163,"_22":164},"Misc","misc","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_175":176,"_177":114,"_178":179,"_180":179,"_181":182,"_183":184,"_185":16,"_186":167},"cspNonce","firebaseOptions",{"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":182},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]