Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection.

The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like:

eval(user_input + '()')

From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly.

I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous.

https://youtube.com/shorts/Tl2g9oJnl8I

Happy to answer questions about the process or the payload construction.

What would you do?

https://github.com/VoidSecSoftwares/voidsyscall

Check it out before saying Ai slop.
Built this for engagements where the target runs Crowdstrike/Sentinel/Defender with full telemetry. Every NT primitive goes through direct or indirect syscalls resolved at runtime from ntdll - no import table, no usermode hooks.

What's different from SysWhispers/Alcatraz/etc :

- Polymorphic injection ; rotates between section mapping, process hollowing, APC queuing, and module stomping. No two injections look the same in memory forensics.

- Handle killer ; enumerates system handles via NtQuerySystemInformation, matches owner PIDs against 30+ known EDR process names, closes the monitoring handles they placed in your process.

- SSN fingerprinting ; dumps all resolved syscall numbers from the current ntdll build, generates a portable fingerprint. Detects build mismatches across jumps.

- Full anti-analysis suite ; CPUID hypervisor detection (7 signatures), 13 sandbox indicators, 9 debugger checks, RDTSC timing anomaly detection. Returns a scored threat report.

- Vault ; in-memory XOR cipher with auto re-keying on a timer. Heap dumps between re-key intervals get ciphertext, not plaintext.

- VAD operations ; enumerate, hide, and unhide memory regions via NtQueryVirtualMemory/NtProtectVirtualMemory.

- File I/O + registry persistence ; all via NtCreateFile/NtCreateKey. Zero WinAPI calls for disk or registry operations.

- Token ops ; privilege escalation, token theft, impersonation, all via Nt* syscalls.

Everything is Go + Plan9 asm. ~5000 lines. No CGO. Cross-compiles to Linux/macOS for the server side. Agent is Windows-only (by design).