Blacklisted
13 solves - 389 points - author writeup
Challenge Description
You can run anything on this!
Final Solution:
>>> @pprintrint
>>> @sorted
>>> @oopenpen
>>> @input
>>> class^LX:pass
type in:
secret_folder/flag.txt
Explanation
After looking at the blacklist string we realize that most of the things we could use for functions are blacklisted. Even the space character isn’t allowed!
blacklist = "._0x6/|?*[]{}<>\"'=()\\\t "
and
blacklist2 = ['eval', 'exec', 'compile', 'import', 'os', 'sys', 'cat', 'ls', 'exit', 'list', 'max', 'min', 'set', 'tuple']
You should notice that the @ character is allowed. Signifiying that we can use decorators to bypass the restrictions.
Python decorators work in the following way:
@print
@input
class X:
pass
is equivalent to:
X = input(X)
X = print(X)
So we need someway to get the secret_folder/flag.txt file using just these decorators. We know that the open function in python allows us to read in a file. So we can use the open decorator to read in the file specified by input.
This would look something like the following:
@print
@open
@input
class X:
pass
which is equivalent to:
X = input(X)
X = open(X)
X = print(X)
A problem can be spotted when running this code, however, because the open function returns a file object, not the file contents. So we get something that looks like this:
<_io.TextIOWrapper name='sample_file_name' mode='r' encoding='UTF-8'>
We need to get the contents of the file, not the file object. A file object is considered an iterable in python, so we can use a function that takes in an iterable. The sorted function does this. So we can use the sorted decorator to get the contents of the file.
@print
@sorted
@open
@input
class X:
pass
Running this code in a python file gives us file read access, but we notice that this code is not working in the interpreter. This is because of the blacklists. We aren’t allowed to use spaces, in class X:
. A simple fix for this is to use the formfeed character, which has similar properties to a space in python. This is allowed in the blacklist, so we can use it to bypass the space restriction. “ ” is the formfeed character.
Another thing we realize is that the open
and print
words are also blacklisted. This is an easy bypass as we can just replace them with pprintrint
and oopenpen
respectively. This works because print
and open
get substituted in for empty characters.
This gives us our final payload:
@pprintrint
@sorted
@oopenpen
@input
class^LX:pass
Note ^L is the formfeed character.
Which when run, all we have to do is type in the flag file name and we get the flag returned to us as a list.
bctf{w41t_h0w_d1d_y0u_d3c0r4t3_th4t?}