smaller-jail — uiuc2026

Description

Now you find yourself in a smaller jail...

Training attribution: Illinois Computes.

The TLS service accepted Java source line by line until DONE, compiled it as UserClass.java, and invoked UserClass.run(). The objective was to read /flag, but the submission first had to pass a learned source-code filter and then escape a Java sandbox.

This was neither a Python jail nor merely a code-golf problem. The complete chain required both a Java 8 SecurityManager bypass and lexical evasion of an adversarially restrictive CNN.

Analysis

Submission pipeline

main.py encodes the submitted UTF-8 source as raw byte values and evaluates MaliciousDetection before compilation:

source_tensor = torch.tensor(list(source.encode("utf8")), dtype=torch.long).unsqueeze(0)
logits = model(source_tensor)

if torch.sigmoid(logits) >= 0.5:
    print("malicious code detected")
    exit()

Accepted source is written to /tmp/UserClass.java, compiled together with Jail.java, and run with Java 8.

Why benign padding cannot cancel malicious features

The detector embeds bytes into 32-dimensional vectors and applies 64 Conv1d filters at each kernel width 3, 5, 10, and 20. ReLU activations are globally max-pooled, producing 256 features. The final layer does not use its learned weights directly:

def effective_fc_weight(self):
    return F.softplus(self.fc.weight)

Every effective final weight is therefore positive. Global max pooling retains the strongest activation seen anywhere for each filter. Appending benign text cannot lower an existing maximum, and positive final weights mean those maxima cannot contribute negatively. Padding may introduce new maxima and make the score worse, but it cannot cancel already detected malicious spans.

The useful optimization target was consequently the source's short byte windows: disrupt suspicious local n-grams while preserving Java semantics.

SecurityManager restrictions

Jail.java installs JailSecurityManager immediately before calling attacker code. It blocks file reads except loading /tmp/UserClass.class, process execution, network access, class-loader creation, and the setSecurityManager runtime permission.

...