> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/web-exploitation/3v-l-medium.md).

# 3v\@l (Medium)

<figure><img src="/files/Nziii9cIH9gXXWGIN9Rg" alt=""><figcaption></figcaption></figure>

This challenge seems to be code-injection type problem. It specifically states it using eval, so that'll be the major hint here.

***

Using eval() is vulnerable for many many reasons. eval() takes the string of an user input and runs it, whether its a simple "eval("2+2")" or something more malicious, and bigger. Even if the function blacklists certain keywords such as "os" or "exec", the system is still vulnerable.&#x20;

```
# Vulnerable code
user_input = input("Enter calculation: ")
result = eval(user_input)  # DANGEROUS!
print(f"Result: {result}")
```

{% embed url="<https://blog.gregscharf.com/2023/04/11/code-injections/>" %}

There's more information about it above.

***

For example, if we run "len("test")" we are returned with:&#x20;

<figure><img src="/files/lfdCVg8rLxME4CwOwYwY" alt=""><figcaption><p>And from this, we know this is Python, and not PHP or JavaScript</p></figcaption></figure>

But from here, I was a little stuck. A lot of sources online didn't help too much, so I used the first hint. "Bypass regex"

Well that didn't really help. But bypassing regex would mean I would need to somehow bypass the following characters:

```
os, eval, exec, bind, connect, python, socket, ls, cat, shell, ".", "/", etc... 
```

So how could I run code without using any of these?&#x20;

I used the rest of the hints, and I needed to encode it, and that the flag would be stored in /flag.txt. Since hex didn't work, we can use ASCII. So using this code it returns the flag!

```
open(''.join([chr(x) for x in [47, 102, 108, 97, 103, 46, 116, 120, 116]])).read()
```

You might also ask yourself why it doesn't count the period before join and read. It's because these periods are run through as syntax, not the strings themselves.&#x20;