https://z3r0s6.github.io/tags/misc/Recent content in Misc on z3r0sHugoenSun, 10 May 2026 00:00:00 +0000https://z3r0s6.github.io/challenges/misccyctf-luxor-sonnet-jail/Sun, 10 May 2026 00:00:00 +0000https://z3r0s6.github.io/challenges/misccyctf-luxor-sonnet-jail/<h1 id="sonnet-jail---writeup"> Sonnet Jail - Writeup <a class="heading-link" href="#sonnet-jail---writeup"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h1> <h2 id="challenge"> Challenge <a class="heading-link" href="#challenge"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <ul> <li><strong>Name:</strong> Sonnet Jail</li> <li><strong>Category:</strong> Misc / PyJail</li> <li><strong>Description:</strong> &quot;I told Sonnet create me a creative pyjail even you can't solve, does it make the job?&quot;</li> <li><strong>Goal:</strong> Read <code>./flag.txt</code></li> </ul> <h2 id="reconnaissance"> Reconnaissance <a class="heading-link" href="#reconnaissance"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>Connecting to the service presents a Python REPL with several restrictions:</p> <pre tabindex="0"><code>&gt;&gt;&gt; print(1+1) 2 &gt;&gt;&gt; print(open(&#34;flag.txt&#34;).read()) [blocked] no dots &gt;&gt;&gt; print(open(&#34;flag&#34; + chr(46) + &#34;txt&#34;)) [blocked] &#39;open&#39; is blocked </code></pre><h3 id="blocked-keywords"> Blocked keywords <a class="heading-link" href="#blocked-keywords"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h3> <table> <thead> <tr> <th>Keyword</th> <th>Message</th> </tr> </thead> <tbody> <tr> <td><code>.</code> (dot character)</td> <td><code>no dots</code></td> </tr> <tr> <td><code>open</code></td> <td><code>'open' is blocked</code></td> </tr> <tr> <td><code>eval</code></td> <td><code>'eval' is blocked</code></td> </tr> <tr> <td><code>exec</code></td> <td><code>'exec' is blocked</code></td> </tr> <tr> <td><code>dir</code></td> <td><code>'dir' is blocked</code></td> </tr> <tr> <td><code>getattr</code></td> <td><code>'getattr' is blocked</code></td> </tr> <tr> <td><code>hasattr</code> / <code>setattr</code> / <code>delattr</code></td> <td>blocked</td> </tr> <tr> <td><code>__builtins__</code></td> <td>blocked</td> </tr> <tr> <td><code>__import__</code></td> <td>blocked</td> </tr> <tr> <td><code>globals</code></td> <td>blocked</td> </tr> <tr> <td><code>breakpoint</code></td> <td>blocked</td> </tr> <tr> <td><code>compile</code></td> <td>blocked</td> </tr> <tr> <td><code>input</code></td> <td>blocked</td> </tr> <tr> <td><code>__subclasses__</code></td> <td><code>blocked string</code></td> </tr> <tr> <td><code>__init__</code></td> <td><code>blocked string</code></td> </tr> <tr> <td><code>flag</code></td> <td><code>blocked string</code></td> </tr> </tbody> </table> <h3 id="allowed-builtins"> Allowed builtins <a class="heading-link" href="#allowed-builtins"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h3> <p><code>print</code>, <code>type</code>, <code>chr</code>, <code>isinstance</code>, <code>vars</code>, <code>list</code>, <code>map</code>, <code>filter</code>, <code>zip</code>, <code>object</code>, <code>bytes</code>, <code>int</code>, <code>str</code>, <code>range</code>, <code>enumerate</code>, <code>len</code>, <code>tuple</code>, <code>set</code>, <code>dict</code>, <code>frozenset</code>, <code>hex</code>, <code>oct</code>, <code>ord</code>, <code>bin</code>, <code>abs</code>, <code>round</code>, <code>sorted</code>, <code>reversed</code>, <code>min</code>, <code>max</code>, <code>sum</code>, <code>any</code>, <code>all</code>, <code>bool</code>, <code>float</code>, <code>complex</code>, <code>super</code>, <code>staticmethod</code>, <code>classmethod</code>, <code>property</code>, <code>slice</code>, <code>memoryview</code>, <code>bytearray</code></p>