NODEJSHELL - Reverse shell exploit for NodeJs deserialization (CVE-2017-5941)

The exploit automatically generates the reverse shell payload which is encoded in decimal and then in base64. After that, this payload is sent via an HTTP POST request that serializes the user input and stores it in a cookie. Then we achieve RCE by accessing through a GET request.

How to use:

python3 nodejshell.py <lhost> <lport>

lhost: your local IP address lport: the port you want to connect your reverse shell to

After that, you just need to provide some simple information:

• Name of the parameter that will send the payload via POST. (Only needed if the cookie is not already set).
• Name of the cookie that will trigger the payload via GET.

Once done, just activate your preferred listener and wait to receive the connection.