> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/binary-exploitation/hash-only-1-medium.md).

# hash-only 1 (Medium

<figure><img src="/files/OClTadqm1DQoGNMFag4d" alt=""><figcaption></figcaption></figure>

***

At the time of this challenge, I couldn't use Ghidra to solve this.&#x20;

<figure><img src="/files/sMkxWERAH2zMv5yZorCM" alt=""><figcaption></figcaption></figure>

If we try to run the file, we get this. Apparently the flag is stored in some directory.

<figure><img src="/files/NT7oKd8auEyPXOtxwsIU" alt=""><figcaption></figcaption></figure>

It's likely doing a md5sum on the /root/flag.txt, however we don't have privileges since it's in the root directory. However, it doesn't run it through something an absolute path like /usr/bin/. I'll explain what this really means.

### Context

If you use a command like echo $PATH, it prints out this output.

<figure><img src="/files/gJCAfKG1K5G59qZZIfW4" alt=""><figcaption></figcaption></figure>

These directories are separated by colons (`:`). When you type a command, the system searches these directories **left to right** until it finds a matching executable. So when you type cat or ls, it in these directories.&#x20;

* **/bin/** - Essential command binaries (like `ls`, `cat`, `cp`)
* **/usr/bin/** - User command binaries (most regular programs)
* **/sbin/** - System administration binaries (like `reboot`, `fdisk`)
* **/usr/local/bin/** - Locally installed programs

So whenever you would type md5sum <>, you're technically invoking from /usr/bin/md5sum.&#x20;

{% hint style="info" %}
`./` means "current directory" Additionally, In Linux, the core difference is thatan **absolute path** specifies a location starting from the **root directory (`/`)**, making it universally consistent, while a **relative path** defines a location based on the **current working directory**, meaning its interpretation depends on where you are in the file system
{% endhint %}

### Solution

For this problem, since the program doesn't use an absolute path for md5sum, we can create our own "md5sum" to replace it. We then need to our fake md5sum.

```
cp /bin/cat ./md5sum
PATH=.:$PATH ./flaghasher
```

The first command copies the program "cat" from bin, and copies it to the current directory with the name "md5sum".&#x20;

The second command is setting "PATH" equal to the current directory path. (".") Visually, it's kinda like this.

```
Your normal path might look like this:
/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
After running PATH=. :$PATH
.:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin

The colon seperates the directories, and when they look for commands, they first look from the left.
```

"./flaghasher" runs the program in the current directory, and it prints out the flag!