**TL;DR**:
- Obtain a code object through stack trickery and the stripping of `MAKE_FUNCTION`: `c = (0, lambda: __import__("os").system("sh"))`
- Call `gift` through `CALL_METHOD` by assigning `gift.x`
- Overwrite `gift.__code__` by calling `gift.x`
- call `gift.x` again to get a shell

[Full writeup](https://org.anize.rs/dicectf-2022/misc/ti1337)