webPromedium

Soviet

alfactf

Task: Python calculator using simpleeval library with random module exposed. Solution: Exploited that random module imports os as _os internally, and name resolution (_eval_name) does not check underscore prefix unlike attribute access (_eval_attribute).

$ ls tags/ techniques/
rcesandbox_escapepythonsimpleevalrandom_module_os_importname_resolutionattribute_access
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups