> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/binary-exploitation/hash-only-2-medium.md).

# hash-only 2 (medium)

<figure><img src="/files/pd6mn51vdDbdjlHQjqcb" alt=""><figcaption></figcaption></figure>

***

If I tried to the similar solution as last time, it doesn't work.

<figure><img src="/files/FU2CPmIXBVXo1sV0yZPh" alt=""><figcaption></figcaption></figure>

This time, we're in "rbash", which is just a more secured version of the standard bash, given its name restricted bash. This means we can't change the PATH, and neither can we use commands&#x20;

{% embed url="<https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html>" %}

<figure><img src="/files/cUIhfeXA3IO4pDENBv5d" alt=""><figcaption></figcaption></figure>

We can also check our configuration using export -p, and it shows us currently using rbash.

### Solving it

{% hint style="info" %}
**`which`** shows you the **full path** of a command that would be executed.
{% endhint %}

This is pretty much like the last CTF, except the thing we want to do is to escape from rbash. After a bit of researching, I came across this guide:

{% embed url="<https://gist.github.com/PSJoshi/04c0e239ac7b486efb3420db4086e290>" %}

<figure><img src="/files/SnsFtuGOuqV6dIj5HrwL" alt=""><figcaption></figcaption></figure>

It's pretty self-explanatory, but basically you would just add that parameter. The `-t` flag forces SSH to allocate a pseudo-terminal (TTY), which makes bash think it's running interactively and work properly. For rbash to actually work, you would need to restrict ssh commands or restrict to just the rbash shell.&#x20;