Skip to content

Latest commit

 

History

History
10 lines (7 loc) · 425 Bytes

description.md

File metadata and controls

10 lines (7 loc) · 425 Bytes

escaped

A simple pyjail! Here, we're given a program that reads in a string and prints it back out, but utilizes a few evals to very insecurely process the input.

The design around this jail was inspired by SQL injection attacks: being able to break out of the quotes by adding in escaped quotes (\x22) to add in arbitrary code execution. One possible solution is:

"\x22,__import__('os').system('/bin/bash'),\x22"