[FIXED] Popen stdout value

Issue

im doing a ctf challenge about an SSTI. The solution payload is

{{"".__class__.__mro__[1].__subclasses__()[213](['cat','flag.txt'],stdout=-1).communicate()}}

I would like to know why stdout accepts -1 as a value. I could not find it in the current subprocess documentation.

Solution

-1 is just the value of subprocess.PIPE

PIPE = -1

Given the convoluted nature of getting a reference to Popen in the first place, subprocess.PIPE itself may not be available, so its value is used instead.

Answered By - chepner