A Message From Author
By Team Cryptonite · 1 min read
About the CTF: Pinaka CTF
He didn't want to learn Linux. He wanted to think like a hacker.
**Pinaka CTF 2026** · Misc & OSINT · Team Cryptonite · All 44 Pinaka write-ups
He didn't want to learn Linux. He wanted to think like a hacker.
So he read one book on his Kindle, highlighted the lines that mattered, and used them to lock his flag. Then he wiped everything. Or thought he did.
All you have is his home folder. The book's name is gone. The book isn't. Everything you need from it is in the free sample: no purchase, no login.
"Sometimes it's not about hacking harder... it's about looking where others don't."
Flag format: CyberHX{...}
Solve
We were given a reader_home.tar.gz file
On extraction, it had these files:
$ tree -a
.
|-- ...
| `-- q
|-- .bash_history
|-- .bashrc
|-- .cache
|-- Documents
| `-- reading-list.md
|-- .local
| |-- share
| | `-- .mc
| `-- state
| `-- .h
|-- .motd
|-- notes
| `-- todo.md
|-- .profile
`-- .vault
`-- flag.enc
Our job is to find the book the author is trying to hint in the description and in reading-list.md
# reading list
- [x] The Linux Command Line
- [x] How Linux Works
- [ ] Linux Basics for Hackers
- [x] #################### (red letters, a hood on the cover. the free sample was enough to get hooked)
- [ ] finish Part VI
In .local/share/.mc
We found initials of the author, K, D and location where the book is clipped
The Book: https://www.amazon.in/Break-Illusion-Getting-Terminal-Understand-ebook/dp/B0GHNJYNHH
this matched the description given in reading-list.md
Locations were given in the free sample
ASIN = B0GHNJYNHH
We need to find 4 words from the book that will unlock flag.enc
How the flag is encrypted is given in local/state/.h
#1793462462
cd ~
#1793462465
ls -la
#1793462472
mount | grep -i kindle
#1793462490
cp "/media/reader/Kindle/documents/My Clippings.txt" ~/.local/share/.mc
#1793462501
grep -c 'clipping limit' ~/.local/share/.mc
#1793462530
Q=$(rev ~/.../q | base64 -d)
#1793462534
xdg-open "https://www.amazon.in/s?k=${Q// /+}&i=digital-text"
#1793462752
export ASIN=$(cat ~/.cache/.asin)
#1793462770
pick(){ tr -cs "A-Za-z'" '\n' | sed '/^$/d' | sed -n "${1}p" | tr 'A-Z' 'a-z'; }
#1793462791
note(){ grep -o 'w=[0-9]*' ~/.local/share/.mc | sed -n "${1}p" | cut -d= -f2; }
#1793462882
vim /dev/shm/h1 /dev/shm/h2 /dev/shm/h3 /dev/shm/h4
#1793463460
for i in 1 2 3 4; do pick "$(note $i)" < /dev/shm/h$i; done | paste -sd- | tr -d '\n' > /dev/shm/.k
#1793463464
printf -- '-%s' "${ASIN,,}" >> /dev/shm/.k
#1793463481
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 250000 -md sha256 -in ~/flag.txt -out ~/.vault/flag.enc -pass file:/dev/shm/.k
#1793463495
shred -u ~/flag.txt /dev/shm/h1 /dev/shm/h2 /dev/shm/h3 /dev/shm/h4 /dev/shm/.k ~/.cache/.asin
#1793463520
sed -i -E 's/^(\xEF\xBB\xBF)?[^(]+\(K[a-z]+ D[a-z]+\)\r$/\1[REDACTED] (K******* D******)\r/' ~/.local/share/.mc
#1793463532
history -w
We just bruted the every word nearby that location. We found pdf of the book from Ocean of PDF.
We then compared the md5 starting bytes with the ones mentioned in .mc and we got these words:
understand disguised permission control
Final key:
understand-disguised-permission-control-b0ghnjynhh
Flag:
CyberHX{y0u_d0nt_l34rn_l1nux_y0u_t4k3_c0ntr0l}