Lab 129 — ReqForge — RCE via VM Sandbox Escape

hackadvisor

Task: Express.js API testing platform executes user-supplied JavaScript in a Node.js vm sandbox for pre-request/post-response scripts. Solution: Escaped the vm sandbox via constructor chain traversal (this.constructor.constructor) to access the main context's process object, then used require('fs') to read /root/flag.txt.