webPromedium
Lab 54 — PulseGuard — RCE via node:vm Sandbox Escape
hackadvisor
Task: PulseGuard monitoring platform allows custom JavaScript monitors running in node:vm sandbox. Solution: escape vm sandbox via constructor chain traversal to access process.mainModule.require('fs') and read /root/flag.txt.
$ ls tags/ techniques/
vm_sandbox_escapeconstructor_chain_traversalfile_read_rceprototype_pollution
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 247 — PulseGuard — SSTI in Webhook Notification Templates— hackadvisor
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor
- [web][Pro]PulseOps — Insecure Deserialization in Config Import— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor