How we obtained a Javascript reverse shell by exploiting a vulnerability on a Node.js application during a security assessment.