After some trial and error I've found out that a lot of functions were blacklisted - and it occured to me that the blacklist was done on a string basis - i.e. I could not use string "os" as it is.Nearly at that moment I've had a dim recollection of seeing somewhere a python code execution with timeit.timeit(). Considering task name, it could not be just a coincedence.And voila, the payload that executed cleanly:```timeit("__im"+"po"+"rt__('o"+"s').s"+"ys"+"tem('ca"+"t "+"fla"+"g.txt')",number=1)```
The flag was:tjctf{iTs_T1m3_f0r_a_flaggg}