private method | Enes Basmaci

01 · CONTEXT

Description of the Challenge

02 · RECON

Recon / Initial Analysis

CODEapp.pyPYTHON

import re

class Main:
    # public 
    def alpaca():
        return "🦙"

    # private
    def __flag():
        return "Alpaca{REDACTED}"

code = input(">>> Main.").strip()

if re.fullmatch(r"\w+\(\)", code):
    print(eval(f"Main.{code}"))
else:
    print("Nope")

We can see here that we have a python app that gets an input, checks it with regex to be <word>() format then executes the python code concatenating to the final of Main.<input>. The goal is to execute the private method.

03 · SOLUTION

Solution

I saw that only no arguments commands are working so I've tried some magic methods that I use in SSTI as well like : mro() and __subclasses__() with no success.

Unsuccessful attemptspowershell

PS> python app.py
>>> Main.mro()

python app.py
>>> Main.__subclasses__()
[<class '__main__.Main'>, <class 'object'>]
[]

Then I searched about private methods on python and found a great resource from geeksforgeeks.org about name mangling.

CODEhttps://www.geeksforgeeks.org/python/private-methods-in-python/PYTHON

# Creating a class
class A:

    # Declaring public method
    def fun(self):
        print("Public method")

    # Declaring private method
    def __fun(self):
        print("Private method")


# Driver's code
obj = A()

# Calling the private member
# through name mangling
obj._A__fun()

Remote Flagpowershell

PS> nc 34.170.146.252 53025
>>> Main._Main__flag()
Alpaca{what_are_alpaca_doing_in_their_private_time?}

04 · FLAG

Flag

FLAGConfirmed Flag

Alpaca{what_are_alpaca_doing_in_their_private_time?}