Jellyspotters
Python pickle deserialisation

Challenge

The leader of the Jellyspotters has hired you to paint them a poster for their convention, using this painting program. Also, the flag is in ~/flag.txt.
nc umbccd.io 4200
Author: nb

Solution

B64 encoded pickle string is loaded.
We can leverage the __reduce__ method to call os.system() with cat ~/flag.txt.
Passing the b64 encoded string into the input, we get the flag.
Copy link