Insecure Deserialization

Challenge Question

This backend service accepts a serialized blob from the client and reconstructs it into a Python object without asking too many questions about what's actually inside. Some serialization formats let the data itself decide what code runs during that reconstruction. Craft a payload that gets the server to do something on your behalf.