[HITCON2016]Leaking

"use strict";

var randomstring = require("randomstring");

var express = require("express");

var {

    VM

} = require("vm2");

var fs = require("fs");

var app = express();

var flag = require("./config.js").flag

app.get("/", function(req, res) {

    res.header("Content-Type", "text/plain");

    /*    Orange is so kind so he put the flag here. But if you can guess correctly :P    */

    eval("var flag_" + randomstring.generate(64) + " = \"hitcon{" + flag + "}\";")

    if (req.query.data && req.query.data.length <= 12) {

        var vm = new VM({

            timeout: 1000

        });

        console.log(req.query.data);

        res.send("eval ->" + vm.run(req.query.data));

    } else {

        res.send(fs.readFileSync(__filename).toString());

    }

});

app.listen(3000, function() {

    console.log("listening on port 3000!");

});