webPromedium

PulseOps — Insecure Deserialization in Config Import

hackadvisor

Task: Node.js/Express operations dashboard with config import/export feature that deserializes user-supplied data via node-serialize. Solution: Exploit node-serialize's _$$ND_FUNC$$_ IIFE pattern to achieve RCE and read /root/flag.txt.

$ ls tags/ techniques/
rcenodejsexpressinsecure_deserializationnode_serializeiifechild_processconfig_import
node_serialize_unserialize_iifend_func_function_injectioncommand_execution_via_child_process_execsync
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups