webPromedium
Lab 129 — ReqForge — RCE via VM Sandbox Escape
hackadvisor
Task: Express.js API testing platform executes user-supplied JavaScript in a Node.js vm sandbox for pre-request/post-response scripts. Solution: Escaped the vm sandbox via constructor chain traversal (this.constructor.constructor) to access the main context's process object, then used require('fs') to read /root/flag.txt.
$ ls tags/ techniques/
decoy_flag_identificationvm_sandbox_escapeconstructor_chain_traversalfile_read_via_require_fsprototype_chain_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 122 — BuildStream — RCE via Expression Sandbox Escape— hackadvisor
- [web][Pro]Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler— hackadvisor
- [web][Pro]Lab 60 — CalcForge — RCE via Expression Evaluator Sandbox Escape— hackadvisor
- [web][Pro]Lab 29 — PackForge — Path Traversal to RCE via Template Injection— hackadvisor
- [web][Pro]Lab 134 — DocForge — FreeMarker SSTI Sandbox Escape via ?api Built-in— hackadvisor