CTF-rootme 题解之 Python - PyJail 1

Link:https://www.root-me.org/en/Challenges/App-Script/Python-PyJail-1

Reference:https://docs.python.org/2/library/inspect.html?highlight=func_code

Solution: 

[ BlackArch ~ ]# ssh -p 2222 [e-mail]
      _           _ _                        ___ ____  
  ___| |__   __ _| | | ___ _ __   __ _  ___ / _ \___ \
 / __| '_ \ / _` | | |/ _ \ '_ \ / _` |/ _ \ | | |__) |
| (__| | | | (_| | | |  __/ | | | (_| |  __/ |_| / __/
 \___|_| |_|\__,_|_|_|\___|_| |_|\__, |\___|\___/_____|
                                 |___/ root-me.org     

[e-mail]'s password:
Permission denied, please try again.
[e-mail]'s password:
Welcome to my Python sandbox! Everything is in exit() function (arg == get the flag!)
>>> print exit.func_code
<code object exit at 0xb7d87b60, file "/challenge/app-script/ch8/ch8.py", line 27>
>>> print exit.func_code.co_consts
(None, 'flag-WQ0dSFrab3LGADS1ypA1', -1, 'cat .passwd', 'You cannot escape !')
>>> exit(exit.func_code.co_consts[1])
Well done flag : YjHRUZEa9irCPS2llubR
Connection to challenge02.root-me.org closed.

28.13.1. Types and members

The getmembers() function retrieves the members of an object such as a class or module. The sixteen functions whose names begin with “is” are mainly provided as convenient choices for the second argument to getmembers(). They also help you determine when you can expect to find the following special attributes:

Type	Attribute	Description	Notes
module	__doc__	documentation string
	__file__	filename (missing for built-in modules)
class	__doc__	documentation string
	__module__	name of module in which this class was defined
method	__doc__	documentation string
	__name__	name with which this method was defined
	im_class	class object that asked for this method	(1)
	im_func or __func__	function object containing implementation of method
	im_self or __self__	instance to which this method is bound, or None
function	__doc__	documentation string
	__name__	name with which this function was defined
	func_code	code object containing compiled function bytecode
	func_defaults	tuple of any default values for arguments
	func_doc	(same as __doc__)
	func_globals	global namespace in which this function was defined
	func_name	(same as __name__)
generator	__iter__	defined to support iteration over container
	close	raises new GeneratorExit exception inside the generator to terminate the iteration
	gi_code	code object
	gi_frame	frame object or possibly None once the generator has been exhausted
	gi_running	set to 1 when generator is executing, 0 otherwise
	next	return the next item from the container
	send	resumes the generator and “sends” a value that becomes the result of the current yield-expression
	throw	used to raise an exception inside the generator
traceback	tb_frame	frame object at this level
	tb_lasti	index of last attempted instruction in bytecode
	tb_lineno	current line number in Python source code
	tb_next	next inner traceback object (called by this level)
frame	f_back	next outer frame object (this frame’s caller)
	f_builtins	builtins namespace seen by this frame
	f_code	code object being executed in this frame
	f_exc_traceback	traceback if raised in this frame, or None
	f_exc_type	exception type if raised in this frame, or None
	f_exc_value	exception value if raised in this frame, or None
	f_globals	global namespace seen by this frame
	f_lasti	index of last attempted instruction in bytecode
	f_lineno	current line number in Python source code
	f_locals	local namespace seen by this frame
	f_restricted	0 or 1 if frame is in restricted execution mode
	f_trace	tracing function for this frame, or None
code	co_argcount	number of arguments (not including * or ** args)
	co_code	string of raw compiled bytecode
	co_consts	tuple of constants used in the bytecode
	co_filename	name of file in which this code object was created
	co_firstlineno	number of first line in Python source code
	co_flags	bitmap: 1=optimized | 2=newlocals | 4=*arg | 8=**arg
	co_lnotab	encoded mapping of line numbers to bytecode indices
	co_name	name with which this code object was defined
	co_names	tuple of names of local variables
	co_nlocals	number of local variables
	co_stacksize	virtual machine stack space required
	co_varnames	tuple of names of arguments and local variables
builtin	__doc__	documentation string
	__name__	original name of this function or method
	__self__	instance to which a method is bound, or None

Note: