mischard

decreasing

tamuctf

Task: Python jail with strictly decreasing \w+ token lengths, empty builtins, banned +-*/=. Solution: Access builtins via __reduce_ex__(2)[0].__builtins__, construct numbers with string comparisons, pad module name for decreasing order, spawn shell with os.system('sh').

$ ls tags/ techniques/
pyjailsandbox_escapepythonevalregexreduce_ex
reduce_ex_builtins_accesswordless_numbersstring_padding_slicebitwise_not_slicing
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]