# Flushed

Author: [roerohan](https://github.com/roerohan)

# Requirements

\- Python

# Source

```  
It is like Rescue Mission all over again! Except this time... the flag was
flushed down the toilet!

Connect here:  
nc jh2i.com 50015  
```

# Exploitation

This challenge is similar to `Rescue Mission`. There's a `flag.png` on the
server, but standard out always executes the `toilet` command on linux, hence
the output is in the form of some ASCII art.

```bash  
$ nc jh2i.com 50015  
user@flushed:/home/user$ ls  
ls  
  
m"" ""#  
mm#mm # mmm mmmm mmmm m mm mmmm  
# # " # #" "# #" "# #" # #" "#  
# # m"""# # # # # # # # #  
# "mm "mm"# "#m"# # ##m#" # # "#m"#  
m # # m #  
"" " ""  
user@flushed:/home/user$  
```

However, `stderr` is not running the `toilet` command.

```bash  
user@flushed:/home/user$ ls 1>&2  
ls 1>&2  
flag.png  
```

You can convert the flag to base64 using:

```bash  
$ nc jh2i.com 50015  
user@flushed:/home/user$ cat flag.png | base64 1>&2  
cat flag.png | base64 1>&2  
iVBORw0KGgoAAAANSUhEUgAABnwAAABdCAIAAAAAOV85AAAAAXNSR0IArs4c6QAAAARnQU1BAACx  
jwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABrOSURBVHhe7d3NdSM7z67hE8CbhHNwCs6gE1AA  
jsJDx+DZHmuqJBzUQator/oet+ACCbJY0n0NtBoqAuBPSe2utXv3//sfAAAAAAAAgFQ8dAMAAAAA  
AACS8dANAAAAAAAASMZDNwAAAAAAACAZD90AAAAAAACAZDx0AwAAAAAAAJLx0A0AAAAAAABIxkM3  
AAAAAAAAIBkP3QAAAAAAAIBkPHQDAAAAAAAAkvHQDQAAAAAAAEjGQzcAAAAAAAAgGQ/dAAAAAAAA  
gGQ8dAMAAAAAAACS8dANAAAAAAAASMZDNwAAAAAAACBZzkO3l5eXp6enP3/+/DP0+bn26+cr+8Xy  
Duq0nFFISyM/137NzXALm7N2f7vB+aIOdw42SvypgN/K58cpAMjFt8pDSfyZYRj/h5Pech66/fff  
fzbjz8/Pf4Y+P/ft7e10OtnrsB25Vy1nFNLSyM/lZnCwOWv3txucL+pw52CjxJ8K+K18fpwCgFx8  
qzyUxJ8ZhvF/OOmt5qHb6+urfaI+Pj7e39/tF/ZOyxqcXGt0uVzO5/PyugzAFrln5OBmmAGbs3Z/  
u8H5PpSfX6rVuHM6STyjeWT9VGAe6rfyI94Mj/bNcJcfWGAqj/atgsSfGYbxfzjp/dtEzUM3m4qx  
iZ5OJ3u1d2yiz8/P31OU0Ofn2i9sO6wL/6lqiO2byTojx7UPN8P+2Jy1+9sNzvdx2FkbO+vvL9UW  
3Dk95J7RJLJ+KjAP9Vu5Lccc7ma4s1PwHfSMgGN5qG8VJP7MMIzzw4m9mq6/TTQ9dFs+WuXdDmwj  
zuezLd5erVd5FxsMO6NhjbgZHGzO2v3tBuf7UBK/VLlzOkk8o0dzf/fkEW+GR/tmOOIZAcfCzxs4  
tAG/TUz90M3qXy4X67W8lnexwfWIRpzRsEbcDA42Z+3+doPzfSh2xCblS5U7p5PrEY34je/+3N89  
eb0XDnYzPNo3w/WI+MACHT3atwruzPV3ib6/TUz90M2cr38tfHnFdsPOaFgjw83gYHPW7m83ON/H  
kfulyp3TQ+4ZPZo7uycPejM81DfDQc8IOJaH+lbBnRnw20TNQzcAAAAAAAAADh66AQAAAAAAAMl4  
6AYAAAAAAAAkq3zo9vT09HzV+18FHtbo/tzfGQ1rdERsztr97Qbn+1ASj5s7pxM2ttr9bd0RV3R/  
p+B7tPUC4/Epw6H1voErH7q9vb2dTid7/dP5XwUe1uj+3N8ZDWt0RGzO2v3tBuf7UBKPmzunEza2  
2v1t3RFXdH+n4Hu09QLj8SnDofW+gf/90O319dVafnx8vL+/2y9+hpfL5Xw+L6/+4FKxijQq72bw  
55y7BKdy175ZW/frnNeN/MGlYhVpVN6t0jKrxFw/LDnbWK6zOYmNhF95r0YWZt0q/QxbUahRybkh  
NDjErxy62m+Sifw5W7g+7pYFSqny7peWyj6/cmKjfn5dQtYZiV/7rsOSs02/yiHWyLknW/Rb4K+V  
O90M/YTm3LKEYbm/LuFwZyT8SSauyC/VUlncQaNJchNXJEKNLFx/ykqJyYRWVHKqhBq19D1iZeGX  
6tdXWOXeN/C/H7rZMsx///13Op3sVcJlwJ/rv6j69PQkVyVcClazUt+NylsZZJJ+WHKqSKlQWErU  
slIpWyezknAZcKyboWVWibl+WHI2s9xbmyOVJSyDqkgpPyw5VaSUHy7je3xvJJI5++Eyvm5FUsoP  
S84NocEhfuXQVQnLoMnIJCVcBmR9qdrgO/5m6EcmKeEyIOuM1iTXD0vONpLrhyWnD2vU4/tZluCH  
JWcbyZVwGdDjZujKZrVxzhKW/G2G5cpgCZcBhzujNX+SclXCMmgbyfXDklNFSvlhyakipfyw5Gwz  
Sa4flpwqUsoPl/E9vtsTyZz9sORUkVKhsJTYRnL9sORsI7l+WHKq+KXkqoRlUBKr3PUG/uWh29Jb  
wufn5/P5bKu1V3tHrkpYKlaRRuXdDDJJPyw5VaRUKCwlqiRuncxKwiPeDC2zSsz1w5Kzjb85UlnC  
MqiKlPLDklNFSvlhv++NRDJnP2xZkZTyw5JzQ2hwiF85dFXCMmgyMkkJE79U7/6boR+ZpISJZyQk  
1w9LzjaS64clp4N+38+yBD8sOdtIroT9boZ+QnOWsJTYZliuDJbwiGck/EnKVQnLoG0k1w9LThUp  
5Yclp4qU8sOSs80kuX5YcqpIKT/s992eSObshyWnipQKhaXENpLrhyVnG8n1w5JTxS8lVyUsgzIM  
uIFrHrrZ6+VysXeW18WtwaViFWlU3s1wnePNOUtYcqpIqVBYSlSxCllbd53UzUlKo8WtwaViFWlU  
3q1ynVTlrBJz/bDkbGMpzuZcC+c0ElLKD0tOFSnlh/aadav0c53yiBVdK21tVHJuCA0O8SuHrkpY  
Bk1GJimhva6Pe3FrcKl4g5Qq7365Vqqs7JNSflhyJiOTlNBes85ISK4flpxtJNcPS04HVt+5J1tc  
V9BlgZIrob12uhn6Cc1ZwlJim2G5MlhCez3cGQl/knJVwjJoG8n1w5JTRUr5YcmpIqX8sORsM0mu  
H5acKlLKD+11/SkrJSZznfLWFZWcKlIqFJYS20iuH5acbSTXD0tOFb+UXJWwDMpgBXvfwDUP3WzA  
+fqXXZdXuSrh33IN1o0SyST9sORUkVKhsJSolbV1MisJbcC6kVyV8G+5Bp1WVN7dJjHXD0vOZs7m  
SGUJy6AqUsoPS04VKeWHNj7rVulH5uyHNr56RVLKD0vODaHBIX7l0FUJy6DJyCQltAHr45arEv4t  
53LuHCklYRlURUr5YcmZjExSQhuQeEZrkuuHJWcbyfXDktOHc0+2kCX4YcnZRnIltAGdboauts9Z  
wmv2VsNyZbCENuCIZ7TmT1KuSlgGbSO5flhyqkgpPyw5VaSUH5acbSbJ9cOSU0VK+aGNX3/K5iRz  
9sOSU0VKhcJSYhvJ9cOSs43k+mHJqeKXkqsSlkFJet/A/37oBgAAAAAAAKAaD90AAAAAAACAZDx0  
AwAAAAAAAJJVPnR7enp6vur9rwInNnp5ebEif6r+QYrQNGSw31euSm6LlvWGJM7Zl9iopVQot6VR  
6ASlUUuub85GclVyJyGz6rciGZzYyC/Vwq8sswpNQ3IPIXHOUqrf1g1rNInEOUspf+vkquS2SCzl  
6zfnve66xFLDyJz73XWhwaIlVySW2ossIXS3+4NbKkuuLzRYtMwqca+ENAoJ5crgYWfkN5KrkjuJ  
0F6J0IpkcL+tG7YiX79SoQUmTqNlY7eofOj29vZ2Op3std/MFomNlv/r3ufnZ4kjQtOQwX5fuRpq  
5GtZb0jinH2JjVpKhXJbGoVOUBq15PrmbCRXQ42GGbaifo38Ui38yqEVCX9Fc0qcs5Tqt3XDGk0i  
cc5Syt86udpvGv30m/Ned11iqWFkzv3uutBg0ZIrEkvtRZYQutv9wS2VJdcXGixaZpW4V6JlRaFc  
GTzsjPxGcjXUaJjQXonQimRwv60btiJfv1KhBSZOo2Vjt6h56Pb6+nq5XM7n8/Ja3u0gt1H1Voam  
8XOw33d9NdrI7rCPj4/393f7hYQ2oPetswjNuUVio5ZSodzGOW8/wZ+NWnId0zZaXw01GmbYiro2  
ksHynbMWvepMMrqitV9XNKHEOQ/bOs6oWnTr1le7TqOTHbdu7Yhblyi6ddV3XcvmPPgZieiRCWdw  
S+XQxjaeQsussvZKtKyoceuGnZHfaH21ZTe6Cp3+2rRbN2ZFvq6lti8wcRpGDmX95xQJl/FR9f+l  
m03LJtf+3/L5EhvZfj0/P9ftVGgaMtjvK1e3N7KRxkaeTid7ldAGtKw3xFoc7mZoKRXKbWkUOkFp  
1JLrm7ORXA01GmbYivo1Wg+2V2Mjv79z1qJX/Una+9tXJCT3EBLnPGzrhjWaROKcQ1snV/tNo59+  
c97rrhu2dYlCW9dy17VsTkuuSCy1F1lC6G73B7dUllxfaLBomVXiXomWFYVyW1bUr5FcDTUaJrRX  
IrQiGdxv64atyNevVGiBidNY97VXY2VvPWapUPPQzSZ0Pp+tq73aOsu7HQxr5AtNo2XOodzv47eR  
67thCcug/o54Mww7o0NszrAVzdlomPvbOv87p+WqGLaiSSTOedjWcUbVJtm6YafA1s1g2NZxRln6  
LWHYGQ07hUM0GrZ1czY6hPvbusRGk5Tqt3Xy5xQJy6Cgmodu1u9yuVjv5bW828GwRr7QNFrmHMq1  
ASb3bqjQst6QxEYtpUK5h9icYSuas9Ew97d1NsDc+s5puSqGrWgSiXMetnWcUbVJtm7YKbB1Mxi2  
dZxRln5LGHZGw07hEI2Gbd2cjQ7h/rYusdEkpfptnVUz339OkbAMCqr866Xn69+bXV67GtbIF5pG  
y5y358rxS1gGDdGy3pDERi2lQrktjUJaGoVy76/RMMNWNKaR/53TcvWnMSuaR+KcW0qFcoc1mkTi  
nFtKTTKNkEnmPMk09tIy51DusEa+xFJ76beElsqh3JZGIYdoFMq9v0aHEFpRy/JbckMSG01SKnEa  
a/LnFAnLoKDKh24AAAAAAAAAbuGhGwAAAAAAAJCMh24AAAAAAABAssqHbk9PT89X7f8+q69fo5eX  
F6v55+ufuvDD0DRCg0VLrkgs5Ttio5ZSLbmhuy6kZVahXBkcWlFogTZy3SikJbefYSuapFHLVREa  
LFpy95I455ZSoVwZ3O+bYRI24fV6W7SUmmQaIf3mvNddZ3XW0ziEljmHcoc18iWW2ku/JUjlYZ+j  
fpUtcb2ifloahXJlcGjrQjtpI9eNQlpyhwntVWhFocGiJbffinyTlJpkGltUPnR7e3s7nU72+n2K  
nfRrtPzP8D4/P7eEoWm0zLklVySW8h2xUUupltzQXRcybEUyOLSi0AJDsxItuf0MW9EkjVquitBg  
0ZK7l8Q5t5QK5crgft8Mkwhtjq+l1CTTCOk3573uusQVDdMy51DusEa+xFJ76bcEqTzsc9Svcr+9  
Ei2NQrkyOLR1oZ0MzUq05A4T2qvQilqW35Lbb0W+SUpNMo0tah66vb6+Xi6X8/m8vJZ3O0hsZKVs  
Ez8+Pt7f3+0X9s72ezQ0jZY55643q5TviI12PKPQXSd3rGPYin4O3r6in6Fj2IqG2fGMtmtpZOH6  
jg1dLRVvCA0WLbl7SZzzsK37ObjTN8MkjnhGvsRSvq5z3uWuG7Z1iVrmHMod1sh3xDMS/Zbws/Kw  
z9H2yjbJ9Y8Qy4Bbhh13S6NQ7rAzGraiYWxWcuds36vGM9ou2mjMinyTlJpzRbfU/5dudoR2kJ3+  
A7xvWY2sjrE6p9PJXu0d29zn52d7cxngh/aL7dMIDRYtuSKxlO+IjfY6o+13nb0a6/J9x/ps8JgV  
yeDtK/oZ+qRRSEtuP8NWtEsj+7WxX3/fsduvXot5QoNFS+5eEuc8bOtkcL9vhknIelu0lJpkGiH9  
5rzXXSfTOISWOYdyhzXyHfGMRL8lSOVhn6Ptle3V2AwH/Egc0tIolCuDt2/dz9AnjUJacjuxKRmb  
0t388d9GmjEr8k1Sas4V/VPNQzc7vPP5bIdtrza58m4HiY1sH43t47Kb5d1tQtNomXPieo94Rr5J  
NmfYekN37LAVDVv+Ic4o5BBn1NJI7tjQ1VLxhmErmkTinIdt3RH3ucURz8g37ASPOGffJNMIaZlz  
KHdYI98Rz0j0W8IhNkd+hCjv3jBsRS2NQrn3t6JhQneOGHZGodxhK/JNUmrOFd1S89DNpnK5XOzI  
l9fybgeJjSzd1N2joWm0zDlxvYmlfEdsNMkZ+ay42XjHDlvRsOUPW9EwhzijlkaL7zs2dLVUvCE0  
WLTk7iVxzsO27oj73OKIZ+QbdoJHnLNvkmmEtMw5lDuske+IZyT6LeEQm2MTM98/QpR3bxi2opZG  
odz7W9EwNhOz8c4Rw84olGsDzIAV+SYpNeeKbqn866Xn6192XV67ympk22fq7lETmkbLnFtyRWIp  
3xEbtZRKnIYjescOW1FLo5CWRsMmGTJsRbs0+nnHbr/6q9Bg0ZK7l8Q5t5QK5bY0OqLE9baUmmQa  
IUecs2+SaYS0zDmUO6yRL7HUXvotYf7N+fkjhG/YiloahXJbGoW0NBo2ye2id44Irahl+dtzR67I  
N0mpSaaxReVDNwAAAAAAAAC38NANAAAAAAAASMZDNwAAAAAAACBZ5UO3p6en56tO/6jqt5eXF2vx  
J+NfkQiVksGh9YZyWxr5Ekv5hjW6g5shJJQbmpUI5Q7bjVAjueoP3suwFbU0Cp2RCDUK2St3Ly2n  
IIZtXeiuE4nrHSZxzqGtk6uT3Cohe22d6DeNQ5C9klDI1dB6WwZL3xZHPCORuBuiZdv73QyipZH9  
eoYVJc6qJdcXaiRX/cF7mfOMEhv5Whr5Jik1yTS2qHzo9vb2djqd7HXjkVdb/k+Bn5+fJW4QKiWD  
Q+sN5bY08iWW8g1rdAc3Q0got+UUWlbUkusLNZKr/uC9DFtRS6PQGYlQo5C9cvfScgpi2NaF7jqR  
uN5hEucc2jq5OsmtErLX1ol+0zgE2St/6+RqaL0tg/1ZhRzxjETiboiWbe93M4iWRpOsKHFWw1bk  
N5Kr/uC9zHlGiY18LY18k5SaZBpb1Dx0e319vVwu5/N5eS3v9rG+V6yvbcTHx8f7+7v9QsJlvCNU  
SgaH1uvk5jZyJJbyDWtk7uBmcBr5fX3RWa01rmidm7giE2okV9fhUm0Gw1ZU3UhyQ/xJRpewtlfu  
juQE5cjW4TL+lpFbF7rrZAnVd92Oss7IhLZufVVyff4kf+27DkvFWnttnVTevnW/SlzRGD/3yt+6  
9VVLD21daHOcA/1bq8Hhzkjk7oZwtv3Xvep0M+Q2mmFFPwevZ/W3lmuvFfmN5Oo6XKrNYMIz8gf/  
reUasyK/spTyB5eKN0ip8u42LbkisdQt9f+lmx2hHWSn/wDvm23B8/PzcmD2aqzp6XSyVwmX8Y5Q  
qfXgZfz29Tq59muT1ciXWMo3rNHRb4a/dW83klByf2XDqk8hlOvshv3afC9Bwp+5vu2N5OrPcBLD  
VtTSKHRGQkoJ/6pvr9y9rE/BXo3N/9bHymeDx2zd9rtOwp+5h5B4Rtu3Tq5auH3rrpW8SVq4/cha  
7LJ1Ev7MbZG4omFsVusbaR1ep/x/5ry+amFo60Kb4xzo8k61I56RsElm7YZwtv3v1kSOzLf9FCSU  
3F9NuCIZvIzffqC7rMjYL241kqs/w0lMeEb+4OUdx5gVXSt5lS28tUAJl4IOG7x9+aIlVySW+qea  
h252eOfz2fbRXm1y5d3+/h7g9QiXHZGwDNpGciUsg760rFdy+zUSw86Im2E7qeyHJWebllkl5soS  
JCw5VfxGcrVlRcMMW1GoUcmp4pdKXEJ5d5vEBe5FjkzCMuiGSbZd5ixhyTkyWZGEZdA2/ta1HIqU  
knCvI5PKEpZB20xy10kjCcugvcle9bvrhFSWsAz6kthXSF8Jy6DJ9NsN4d8MEpacKlLKD0tOlUlW  
VAZ9aTnQYSvyG8nVlhUNI0uQsAz60u+MyqAvLY2ksoRl0JdQIyklob9ACUvFGxL3ubxbJbHULTUP  
3Wwql8vFdnN5Le/2dz3ByhMVkithGfSlZb2Su+jRSCSW8g1rJKyX+d5JCcugbSRXwjLoS8t6r4Vv  
NpKw5GzTMqvE3EXKioTfSK5KWEpMZtiKQo1KThW/VOISyrvbJC5wLzZt831kEpZBN0yy7Yu6JRyC  
rEjCMmgbf+vkasnZ5lrp5iT9vhKWihmksoRl0DZ7LUFIIwnLoL3JXkm4+J6zXC0lqlwLb92cxL7i  
2nb2MxL9dkNIo0WPvZJSflhyqliFGVZUBn2RWZV3t5Hcxca+IX4juSphKTEZm5j5XoKEZdCXlhVJ  
7qJHo2vhLiu6VrpZWUotbg0uFW+QUuXdbVpyRWKpWyr/eun5+pddl9dhbAtM3YkKyZWwDFppWe86  
t2sjkVjKN6zRmuykhGXQNpIrYRm0Ur1eqeyHJWezllPIypUlSHgdXs9pJFd/hnNaT7Lrita5vzZq  
4ZdqabRX7gzkyCQsg27ba+vWuTJnCa/Dj01WJGEZtJmzdXI1REpJaAOcvhL+LZdEKktYBm22yxKE  
NJKwDJrAeq8k/DlnGVxNKktYBq1k9RXSV8IyaD6dduOndSPZHAmvwytJKT8sObVmWFEZtLKeVdSY  
FRmnkVz9GU5IliBhGbTSsqJ1br9GUlnCMmhleyMpJaENWJeSqxL+LefaPqufWnJFYql/qnzoBgAA  
AAAAAOAWHroBAAAAAAAAyXjoBgAAAAAAACTjodtcnp6enq/S/7Xal5cXq/nn69/jkBAAAAAAAAzT  
74//WNv3YQgP3eby9vZ2Op3sNf0OWP53hp+fn/8MAQAAAADAMP3++I+1fR+G8NCtr9fXV/sIfXx8  
vL+/2y/KuzfY4Mvlcj6fl9fybhIeugEAAAAA0Mk8f/zHGg/d7pl90owd6ul0stfy7m022I7fRqb/  
96X2kX5+frb6/wwBAAAAAEC1v3/4n+OP/1jb92EID936+vuZu37qls9SefcGO/jz+WyfT3u18eVd  
AAAAAAAwN/74j5946NZX6FNnYy6Xi41fXsu7AAAAAABgbtc//fPHf/wfPHTr6/qh2/qpM8vf5V5e  
AQAAAADAIfDHf/zEQzcAAAAAAAAgGQ/dAAAAAAAAgGQ8dAMAAAAAAACS8dBttJeXl6enpz9f/zqJ  
hAB68z+DLSEOJ/H0JUSWxEORENhd4v0sIbIkHoqEwONI/OBIeAh3sAQ04qHbaMv/VfHz8/OfIYDe  
/M9gS4jDSTx9CZEl8VAkBHaXeD9LiCyJhyIh8DgSPzgSHsIdLAGNeOg2Gp86YF/+Z7AlxOEknr6E  
yJJ4KBICu0u8nyVElsRDkRB4HIkfHAkP4Q6WgEY8dBvt9fX1+fn57e3tnyGA3vzPYEuIw0k8fQmR  
JfFQJAR2l3g/S4gsiYciIfA4Ej84Eh7CHSwBjXjoBgAAAAAAACTjoRsAAAAAAACQjIduAAAAAAAA  
QDIeugEAAAAAAADJeOgGAAAAAAAAJOOhGwAAAAAAAJCMh24AAAAAAABAMh66AQAAAAAAAMl46AYA  
AAAAAAAk46EbAAAAAAAAkIyHbgAAAAAAAEAyHroBAAAAAAAAyXjoBgAAAAAAAKT63//+P7cG0V1Q  
7/PfAAAAAElFTkSuQmCC  
```

Store this base64 string in a file called `flag.txt`. Now decrypt it and store
it in `flag.png`.

```bash  
$ cat flag.txt | base64 -d > flag.png  
```

Open `flag.png` and read the flag.  
  

The flag is:

```  
flag{flushed_down_the_toilet_but_rescued_again}  
```

Original writeup (https://github.com/csivitu/CTF-Write-
ups/tree/master/HacktivityCon%20CTF/Scripting/Flushed).