# Verify

## Challenge Description

People keep trying to trick my players with imitation flags. I want to make sure they get the real thing! I'm going to provide the SHA-256 hash and a decrypt script to help you know that my flags are legitimate.

You can download the challenge files here:

* [`challenge.zip`](https://artifacts.picoctf.net/c_rhea/21/challenge.zip)

Additional details will be available after launching your challenge instance.

***

## Solution

First start the instance and login via ssh to the given instance. We are given with two files and a folder.

<figure><img src="https://2035863894-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjvlUrxK6i7ZNmn3d6e8B%2Fuploads%2FxQSANPSKp3PQNN1YCZoR%2Fimage.png?alt=media&#x26;token=6218e1e8-9baf-4bd1-9aab-18ba209a9703" alt=""><figcaption></figcaption></figure>

The `checksum.txt` file contains the hash sum of some file.

<figure><img src="https://2035863894-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjvlUrxK6i7ZNmn3d6e8B%2Fuploads%2F5q1NNpqsKwwteEV0sjVp%2Fimage.png?alt=media&#x26;token=821a2c9b-4b59-4b91-92e9-5642525a9bb3" alt=""><figcaption></figcaption></figure>

The `decrypt.sh` file is a bash script, which tries to decrypt a file.

<figure><img src="https://2035863894-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjvlUrxK6i7ZNmn3d6e8B%2Fuploads%2FdDOkwEzMvTXwcKEp3htq%2Fimage.png?alt=media&#x26;token=bbd3a094-432d-4d11-b38c-592864d53fe0" alt=""><figcaption></figcaption></figure>

Next I checked the files directory. It has a lot of files. One of these files has the flag in encrypted form. We have to decrypt that file using the `decrypt.sh` file. We have to decrypt each file in this directory to find the flag.

<figure><img src="https://2035863894-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjvlUrxK6i7ZNmn3d6e8B%2Fuploads%2F6fXT5KxyPU2NkzSFRY75%2Fimage.png?alt=media&#x26;token=0b329ebf-ad3a-4633-88aa-3a462d61a482" alt=""><figcaption></figcaption></figure>

I used a bash while loop to get the job done. Use the following command to get the flag.

```bash
ls -R | while read filename; do ./decrypt.sh ./files/$filename 2>/dev/null; done | grep picoCTF
```

<figure><img src="https://2035863894-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjvlUrxK6i7ZNmn3d6e8B%2Fuploads%2FoBzQ3mtHfXNYVyIZKojM%2Fimage.png?alt=media&#x26;token=96b624f4-b614-4492-9a30-45328366ee96" alt=""><figcaption></figcaption></figure>

Flag: `picoCTF{trust_but_verify_e018b574}`