webPromedium

MetricForge

hackadvisor

Task: Business analytics platform with custom formula evaluation using Node.js vm module sandbox. Solution: Escape the vm sandbox via prototype chain traversal (this.constructor.constructor) to access the main process context, require fs, and read /root/flag.txt.

$ ls tags/ techniques/
rcenodejssandbox_escapejavascriptexpressdecoy_flagformula_injectionvm_sandboxprototype_chain
arbitrary_file_readprototype_chain_traversalvm_sandbox_escapeconstructor_chain_traversal
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups