**TL;DR**:- Obtain a code object through stack trickery and the stripping of `MAKE_FUNCTION`: `c = (0, lambda: __import__("os").system("sh"))`- Call `gift` through `CALL_METHOD` by assigning `gift.x`- Overwrite `gift.__code__` by calling `gift.x`- call `gift.x` again to get a shell
[Full writeup](https://org.anize.rs/dicectf-2022/misc/ti1337)