miscPromedium

Escape via Brainfuck

bug-makers

Task: Brainfuck interpreter whose output is passed to Python exec(); input is restricted to the 8 BF chars and 100 bytes. Solution: use a fixed-count BF cat (',.' repeated) to echo a Python payload from stdin into exec(), reading flag.txt β€” sent in a single packet to dodge PTY CRLF/EOF pitfalls.

$ ls tags/ techniques/
sandbox_escapebrainfuckesolangjail_escapeexec_injectionpty
bf_cat_to_rceexec_sink_injectionfixed_count_catsingle_packet_send
πŸ”’

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups