Shame on Shou if his web app has XSS vulnerability. More shame on him if he does not know how to use CSP correctly.
This challenge requires user interaction. Send your payload to uv.ctf.so Flag is in cookies of admin (Shou).
Hint: Search Content-Security-Policy if you don't know what that is and check your browser console.
Host 1 (San Francisco): csp1.sf.ctf.so
Host 2 (Los Angeles): csp1.la.ctf.so
Host 3 (New York): csp1.ny.ctf.so
Host 4 (Singapore): csp1.sg.ctf.so