[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_151":152,"_153":146},"routes/_root/_root",{"_148":-7,"_38":149,"_120":-7,"_150":-7},"routes/_root.challenges",{"_34":144,"_145":146,"_147":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_53":54,"_55":56,"_57":58},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":21},"solved",false,"hasWriteup","writeups",[23,24],"name","vm1","canonicalName",{"_25":45,"_27":46,"_29":47,"_31":16,"_32":16,"_33":16,"_34":48,"_36":49,"_38":39,"_40":16,"_41":50},{"_25":26,"_27":28,"_29":30,"_31":16,"_32":16,"_33":16,"_34":35,"_36":37,"_38":39,"_40":16,"_41":42},"author",{"_20":43,"_44":-5},"writeupElementId","529d65e4","writeupId","529d65e4-1fd1-4d9b-857e-2a4765702dd7","canEdit","canLike","likedByViewer","title","Daily AlpacaHackに挑戦するつくよみちゃん 06/03/vm:1/minaminao","url","https://youtu.be/ZIsOFWbPXlE","language","ja","isOfficial","createdAt",["D",1780507211569],"tsukuyomi-chan","gravatarHash",{"_20":51,"_44":52},"ac04999a","ac04999a-09ee-463a-9e9a-7b6d85047089","Writeup for vm1","https://github.com/tadanobutubutu/vm1-solve/blob/main/README.md",["D",1780500156141],"tadanobutubutu","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51","challenge",{"_20":21,"_22":21,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":16,"_77":-7,"_78":79,"_80":-7,"_81":-7,"_33":16,"_82":83,"_84":85,"_86":16,"_87":-7,"_88":16,"_89":-7,"_90":-7,"_91":92,"_93":-7,"_94":-7,"_95":-7,"_96":97,"_98":16,"_99":97,"_32":97,"_100":-7,"_101":102,"_103":104,"_105":106,"_107":108},"availablePages",[59,60,61],"canonicalUrl","https://alpacahack.com/challenges/vm1","Description","Solves","Writeups","solves",77,"flagFormat","Alpaca{...}","categories",[141],"attachments",[137],"remote",{"_134":135,"_136":97},"description","\n\n>The `node:vm` module is not a security mechanism. Do not use it to run untrusted code.\n\nI do not believe so\n\n

Beginner Hint 1: Challenge Overview (AI-translated)

\n\n- If you read the distributed `jail.js`, you can see that the JavaScript code you input is executed with `runInNewContext` from `node:vm`.\n- Roughly speaking, `runInNewContext` is used as `runInNewContext(code, contextObject, options)`. The first argument is the code to execute, the second argument is the global object visible from that code, and the third argument is the runtime options.\n- In this challenge, `runInNewContext(code.toString(), {}, { timeout: 1000 })` is executed. In other words, your input code is executed in a new context, and an empty `{}` is passed as the global object. `timeout: 1000` is a setting to stop execution that runs for too long.\n- The flag is stored in the environment variable `FLAG`, and in normal Node.js code, you can obtain it with `process.env.FLAG`. However, in this challenge, the `{}` passed as the second argument to `runInNewContext` does not contain `process`, so it fails with `ReferenceError: process is not defined`.\n- So how can you obtain `FLAG`?\n\n

\n\n

Beginner Hint 2: Approach (AI-translated)

\n\n- At first glance, it looks like you cannot access objects such as `process`, but that is not actually the case.\n- In JavaScript, when reading an object's property, if the property does not exist on the object itself, properties on the prototype chain are also searched.\n- In the vm context, focus especially on the `constructor` property among the properties visible from `globalThis`, and try investigating it.\n\n

\n\n

Beginner Hint 3: A More Detailed Approach (AI-translated)

\n\n- `globalThis.constructor.constructor` becomes the `Function` constructor, which can create functions from strings.\n- In which context is a function created with this evaluated?\n\n

\n","descriptionJa","\n\n>The `node:vm` module is not a security mechanism. Do not use it to run untrusted code.\n\n自分はそうは思いません\n\n

初心者向けヒント1: 問題概要

\n\n- 配布された `jail.js` を読むと、入力した JavaScript コードが `node:vm` の `runInNewContext` で実行されていることがわかります。\n- `runInNewContext` は、おおまかに `runInNewContext(code, contextObject, options)` の形で使います。第1引数は実行するコード、第2引数はそのコードから見えるグローバルオブジェクト、第3引数は実行時のオプションです。\n- この問題では `runInNewContext(code.toString(), {}, { timeout: 1000 })` が実行されています。つまり、入力したコードは新しいコンテキストで実行され、グローバルオブジェクトとして空の `{}` が渡されています。`timeout: 1000` は、長すぎる実行を止めるための設定です。\n- フラグは環境変数 `FLAG` に入っており、普通は `process.env.FLAG` で取得できます。しかし、この問題では `runInNewContext` の第2引数の `{}` には `process` が入っていないので、 `ReferenceError: process is not defined` となり失敗します。\n- では、どうすれば `FLAG` を取得できるでしょうか？\n\n

\n\n

初心者向けヒント2: 解法へのアプローチ

\n\n- 一見すると `process` などのオブジェクトにはアクセスできなさそうですが、実はそうではありません。\n- JavaScript では、オブジェクトのプロパティを読むとき、そのオブジェクト自身になければプロトタイプチェーン上のプロパティも探索されます。\n- vm のコンテキストで `globalThis` から見えるプロパティの中でも、特に `constructor` に注目して調査してみましょう。\n\n

\n\n

初心者向けヒント3: もう少し踏み込んだアプローチ

\n\n- `globalThis.constructor.constructor` は文字列から関数を作るための `Function` コンストラクタになります。\n- これを使って作った関数はどのコンテキストで評価されるでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[131],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[122,123,124],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_109":110,"_91":92,"_111":112,"_113":114,"_115":116,"_117":118},"nextDailyCanonical","small-e","httpsProxyHostname","vm1.chal.alp4ca.com","program",{"_22":102,"_20":119,"_120":121},"scheduledDate",["D",1780412400000],"releaseAt",["D",1780412400000],"status","PUBLISHED","plannedTopic","Jail, JavaScript","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":129,"_22":130},{"_20":127,"_22":128},{"_20":125,"_22":126},"Node.js","node-js","JavaScript","javascript","Jail","jail",{"_20":132,"_44":133},"minaminao","8923101afaa06c6be81216763685dbd0cac8ff24fbd6646250f67608d4924b02","instances",[],"canSpawn",{"_138":139,"_36":140},"fileName","vm1.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/0717dc10-e3f7-4380-9443-da010c8c63a1/vm1.tar.gz",{"_20":142,"_22":143},"Misc","misc","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_154":155,"_156":97,"_157":158,"_159":158,"_160":161,"_162":163,"_164":16,"_165":146},"cspNonce","firebaseOptions",{"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":161},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]