Tags: bash 

Rating: 3.0

We are thrown into a shell that adds the prefix 'wa' to each command line parameter.

```
_ _
__ __ __ __ _ | |__ __ _ ___ | |_
\ V V // _` | | '_ \ / _` | (_-< | ' \
\_/\_/ \__,_| |_.__/ \__,_| /__/_ |_||_|
_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'

$ `bash`;
sh: 1: wabash: not found
$ ls
sh: 1: wals: not found
```

we can use the command '(wa)it' to escape this condition
```
$ it&&ls
run
```
We can use the "[internal/input field separator](https://en.wikipedia.org/wiki/Input_Field_Separators)" variable IFS to print our flag.txt content.
```
$ it&&cat${IFS}/flag.txt
bctf{wabash:_command_not_found521065b339eb59a71c06a0dec824cd55}