How to play

Seven commands, and you will use four of them. They behave the same way for every challenge, so the first one teaches you the whole tool. This page is the reference: keep it open in another tab while you play.

4 core commands 3 for when you need them 6 challenges, 120 points

Before you begin

The tool is installed once and then stays out of the way. Three things should be true before you start.

Termux is installed From F-Droid, not the Play Store, which ships a version that no longer receives updates.
The tool is installed Four commands, listed on the Termux CTF page. The installer prints everything it is about to write and waits for you to agree.
ctf responds Run ctf list. If the command is not found, open a new Termux session so the shell picks up the updated search path.

A fresh install has no challenge files on disk. Each one is written when you start it, and removed when you reset it.

Command reference

These four are the whole game. Every challenge is played with them.

Command	What it does
`ctf list`	What is installed, and what you have captured.
`ctf start <id>`	Read the briefing and set the challenge up.
`ctf check <id> <flag>`	Hand in a flag you found.
`ctf reset <id>`	Put a challenge back to how it started.

Three more exist for the moments the four above do not cover.

Command	What it does
`ctf hint <id>`	Reveal the next hint, one at a time.
`ctf export`	A receipt of your progress, to paste back here.
`ctf doctor`	Check that everything is where it should be.

Arguments

Wherever a command takes an <id>, the number and the name are interchangeable. ctf start 01 and ctf start hidden-file do the same thing, so you can use whichever is easier to type.

Exit codes

ctf check exits 0 when the flag is right and 1 when it is not, so a script can branch on the result. ctf doctor exits 1 if anything is wrong with the installation. Every other command exits 0.

The menu

Running ctf with no arguments opens a numbered menu instead of printing a wall of text, because typing on a phone is the worst part of any terminal tool. It is the same seven commands, and it stays open until you quit. Piped into another command it prints the reference text instead, so a script never ends up waiting for input that will not arrive.

A worked example

The first challenge, from beginning to end. Nothing here is specific to it: the other five follow exactly the same shape.

1. See what is on offer

ctf list

  ────────────────────────────────────────────────
    01   hidden-file          Easy     10 pts  open
    02   owner-only           Easy     15 pts  open
  ────────────────────────────────────────────────
    0 of 6 captured, 0 of 120 points

The last column is the only one that changes as you play. It reads open until you capture a challenge and captured afterwards.

2. Read the briefing and set it up

ctf start 01

Two files were written into your home directory before you started.

Both have names that begin with a dot. A plain listing leaves those out,
which is why a directory can look emptier than it is.

One of the two holds your flag. The other is noise.

  Ready. 2 file(s) are in place in your home directory.

The briefing teaches the concept the challenge is testing. It deliberately stops short of the answer, and it does not name the files it wrote.

3. Find the flag

This part is yours. The briefing points at the tool, and the hint narrows the search further if you want it. A plain ls shows nothing here, which is the first half of the lesson.

ls -a

cat .backup-52b09ac4

The name is derived from your device, so yours will differ.

4. Hand it in

ctf check 01 LEARMUX{...}

The tool decides. It is the only thing holding your seed.

  LEARMUX{3f2a91c4b7e05d18}
  Correct. 01 captured, 10 points.

  10 of 120 points.  ctf list to see what is left.

What a flag looks like

Every flag has the same shape: the word LEARMUX, an opening brace, sixteen hexadecimal characters, and a closing brace. Twenty-five characters in total. There is no whitespace inside one, and nothing about it is case-insensitive.

LEARMUX{3f2a91c4b7e05d18}
        └──────────────┘
        16 hex characters

Knowing the shape is useful when a flag is rejected. If what you copied does not match, the problem is almost always a partial copy rather than a wrong answer.

When something goes wrong

Symptom	What to do
A flag is rejected	Check the shape first: twenty-five characters, no spaces, nothing missing from either end. If it looks right and is still refused, it is not the flag.
The files are not there	You may have reset or edited them past the point where they make sense. `ctf reset <id>` puts a challenge back to how it started, and your captures are untouched.
The briefing went past too fast	Run `ctf start <id>` again. It reprints everything and changes nothing, so it is always safe.
You are stuck	`ctf hint <id>` reveals one hint at a time and remembers how many you have seen, so asking again moves you forward rather than starting over.
Something behaves oddly	`ctf doctor` checks the installation and names what is wrong. Run it before anything else.
`ctf` is not found	Open a new Termux session so the shell reloads its search path, or run the installer again. It is safe to run more than once, and your progress stays.

Where everything is kept

The tool, your progress and your hint counts live in ~/.learmux. The command itself is installed into $PREFIX/bin, which is already on your search path in Termux. Challenge files are written into your home directory, the way any other file would be.

Every path the tool creates is recorded in a manifest as it goes. That is what lets the uninstaller remove exactly those paths and nothing else, so anything you put in your home directory yourself stays where it is.

./uninstall.sh

Prints the full list of what it will remove, then asks.

See the challenges Show your progress here Read the source