caas - PicoCTF
March 15, 2022•102 words
Look at the JS provided, while at a first look you might think there might be some SSTI involved, once you look at the code it's clear: Node runs a system command inserting user input. We only need to stop the current program's execution and start something more useful. A combination of a semicolon and anything else you might want to use is fine. For example, I used ls to see file names in the current directory and then printed the one that interested me, like this:
https://caas.mars.picoctf.net/cowsay/message;%20cat%20falg.txt