Navaja Negra 2019 - Mojo

index.js

const crypto = require('crypto');
const vm = require('vm');
process.env.FLAG = "FLAG"
const secret = (key) => ((key == 1337) ? process.env.FLAG : 'fail');
const sandbox = {[crypto.randomBytes(32).toString('hex')] : secret};

const message = 'this.constructor.values(this).shift()(this.constructor.values(this.constructor).concat(this.constructor.values(this.constructor).concat(null).length).concat(this.constructor.values(this.constructor).concat(null).concat(null).concat(null).length).concat(this.constructor.values(this.constructor).concat(null).concat(null).concat(null).length).concat(this.constructor.values(this.constructor).concat(null).concat(null).concat(null).concat(null).concat(null).concat(null).concat(null).length).join(this.constructor.name.repeat()))';
// ...
		if (message.match(/^[a-z.()]+$/)) {
			try {
				let resp = vm.runInNewContext(message, sandbox, {timeout: 1000});
        console.log('resp', resp)
				console.log('ok', JSON.stringify({response: String(resp)}));
			} catch(e) {
				console.log('err', JSON.stringify({error: 'runtime error'}));
			}
		} else {
			console.log(JSON.stringify({error: 'noob'}));
		}