miscProhard

Ergastulum

0xl4ugh

Task: Python jail with ast.Call banned but decorators allowed, empty builtins, only __loader__ available. Solution: Use decorators as function calls (not ast.Call nodes), extract strings from __doc__ attributes, traverse modules via __globals__ to reach os.system.

$ ls tags/ techniques/
python_jailpyjailsandbox_escapedecorator_abuseast_bypass
decorator_as_calldocstring_extractionmodule_traversalglobals_access
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups