Introduction

You rarely break into a system and find a shell waiting for you. A bug gets your foot in the door, one command you can run or one file you can write, and from there you have to build your way up to real control of the box.

What you're building toward is a shell that talks back to you, and there are two ways to wire one up. A bind shell has the target open a port and wait for you to connect, which falls apart the moment a firewall blocks the way in, NAT hides the target, or someone notices the open port. A reverse shell flips the direction: the target connects to you. Outbound traffic is usually trusted, so the machine slips out past the firewall and hands you a shell from the inside.

The server is already running, and it keeps trying to call home: once a second it dials out to 127.0.0.1 on port 1337. Nothing answers until you do. Get a listener up on that port and catch the shell it throws you.

A bind shell works the opposite way. The target opens a port and waits, and you connect to it.

That needs an open path from you to the target, which is the thing you usually don't have. So it's situational: useful when you're already inside the network, or when it's the outbound connections being watched and the inbound ones slip by.

The server is already up, and it's already listening: a shell sits waiting on 127.0.0.1 port 1337. Connect to it and grab the flag.

A URL parser sorts every byte into one of two piles: content, or punctuation. & marks the end of one parameter, = divides a name from its value, and the moment the parser spots one it splits the string right there, whether or not that's what you meant.

That's fine until the value you actually need to deliver is built out of those very bytes. Send them raw and your input gets sliced apart before the server ever sees it whole.

The server is already up, and it reads a payload argument. Check /challenge/server to see what it expects. Your job is to smuggle your delimiter bytes all the way into payload without the parser prying them loose along the way.

Not every payload is a line of shell. When a server runs whatever you feed it, nothing says you have to feed it a script instead of a whole compiled program.

The server is already up. It pulls a URL-safe base64 blob out of an elf parameter, decodes it, and runs the ELF you sent. Read /challenge/server for the details. Write an ELF that goes after the flag, encode it, ship it over, and let the server run it for you.