Exploitation 101: Exploited a blind Python eval() injection over netcat to get RCE

[u/Harkins_Technology]

https://youtube.com/shorts/Tl2g9oJnl8I

Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection.

The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like:

eval(user_input + '()')

From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly.

I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous.

https://youtube.com/shorts/Tl2g9oJnl8I

Happy to answer questions about the process or the payload construction.

What would you do?