> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/dawgctf-2021/jellyspotters.md).

# Jellyspotters

## Challenge

The leader of the Jellyspotters has hired you to paint them a poster for their convention, using this painting program. Also, the flag is in \~/flag.txt.

nc umbccd.io 4200

Author: nb

## Solution

B64 encoded pickle string is loaded.

![](/files/-M_EDHEdKcZ9JbLJsD0k)

Reference: <https://davidhamann.de/2020/04/05/exploiting-python-pickle/>

We can leverage the `__reduce__` method to call `os.system()` with `cat ~/flag.txt`.

![](/files/-M_EDLFIxeAmp5R2QVsQ)

Passing the b64 encoded string into the input, we get the flag.

![](/files/-M_EDMhpK_7ZD6vNW0JW)