Been looking at this box for days and stuck on initial payload. I’ve been trying to execute shells and commands. Commands don’t seem to execute. The shell payload seems to work fine but nc doesn’t hear anything. Anyone willing to give a nudge?
Try to find out what the technology it is using what expression that could be evaluated in the background. Get a local environment where you can experiement with the same type of expressions, but instead of black box you see what code you are using. Maybe you can figure out what is happening on the backend based on experimentation?