when i just the website i tested ssti on input and here is the test:
![](https://i.ibb.co/C0v1dcx/image.png)
it worked so i make sure to have RCE on that.
![](https://i.ibb.co/8zhHzGP/image.png)
so yeah i have now rce and just need to cat flag
![](https://i.ibb.co/kmGPxxn/image.png)