AES-CBC known plaintext-ciphertext pair with IV control.
After that its a simple PyJail escape.
Full writeup: [https://ctf.rip/write-ups/pwn/crypto/nitectf-cbc-jail/]https://ctf.rip/write-ups/pwn/crypto/nitectf-cbc-jail/)