Nightfall

They blocked the usual suspects — ; & | \ < >, cat/bash/sh, spaces, /bin, /etc/shadow. But notice what's missing from that list. And notice $host` doesn't just get printed — it gets parsed twice. What shell trick lets you sneak a whole command through as plain text?

The script checks your input for danger, then hands it to eval as root. That gap between checking and executing is where you live. Find an input that satisfies the check but still means something different once eval gets hold of it.