webmedium

Soviet

alfactf

Task: Python calculator using simpleeval library with random module exposed. Solution: Exploited that random module imports os as _os internally, and name resolution (_eval_name) does not check underscore prefix unlike attribute access (_eval_attribute).

$ ls tags/ techniques/
rcesandbox_escapepythonsimpleevalrandom_module_os_importname_resolutionattribute_access
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]