-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathdist.tar
158 lines (132 loc) · 20 KB
/
dist.tar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
dist/ 0000777 0000000 0000000 00000000000 00000000000 006735 5 0000000 0000000 dist/Dockerfile 0000777 0000000 0000000 00000000247 00000000000 010655 0000000 0000000 FROM node:16.13.1-bullseye-slim
RUN mkdir -p /app
WORKDIR /app
COPY package.json .
RUN npm install
COPY . .
USER node
CMD ["node", "index.js"] dist/flag.txt 0000777 0000000 0000000 00000000017 00000000000 010330 0000000 0000000 dice{test_flag} dist/index.js 0000777 0000000 0000000 00000003636 00000000000 010335 0000000 0000000 const express = require('express');
const fsp = require('fs/promises');
const crypto = require('crypto');
const { NodeVM } = require('vm2');
const vm = new NodeVM({
eval: false,
wasm: false,
wrapper: 'none',
strict: true
});
const PORT = process.env.PORT || 80;
const users = [
{ user: "strellic", pass: "4136805643780af20755baddcc947d20f7e38e52f421c3c89a5a8b9d8a8d1da7" },
{ user: "ginkoid", pass: "cdf72d24394745eab295c6e047ee41aaec62f56bd41e2cea4ef7d244d96b51dd" }
];
const sha256 = (data) => crypto.createHash('sha256').update(data).digest('hex');
const app = express();
app.set("view engine", "hbs");
app.use(express.urlencoded({ extended: false }));
app.get("/", (req, res) => res.render("index"));
app.post("/", (req, res) => {
const { calc } = req.body;
if(!calc) {
return res.render("index");
}
let result;
try {
result = vm.run(`return ${calc}`);
}
catch(err) {
console.log(err);
return res.render("index", { result: "There was an error running your calculation!"});
}
if(typeof result !== "number") {
return res.render("index", { result: "Nice try..."});
}
res.render("index", { result });
});
app.get("/admin", (req, res) => res.render("admin"));
app.post("/admin", async (req, res) => {
let { user, pass } = req.body;
if(!user || !pass || typeof user !== "string" || typeof pass !== "string") {
return res.render("admin", { error: "Missing username or password!" });
}
let hash = sha256(pass);
if(users.filter(u => u.user === user && u.pass === hash)[0] !== undefined) {
res.render("admin", { flag: await fsp.readFile("flag.txt") });
}
else {
res.render("admin", { error: "Incorrect username or password!" });
}
});
app.listen(PORT, () => console.log(`vm-calc listening on port ${PORT}`)); dist/package.json 0000777 0000000 0000000 00000000457 00000000000 011154 0000000 0000000 {
"name": "vm-calc",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "Strellic",
"license": "ISC",
"dependencies": {
"express": "^4.17.2",
"hbs": "^4.2.0",
"vm2": "^3.9.5"
}
}
dist/views/ 0000777 0000000 0000000 00000000000 00000000000 010072 5 0000000 0000000 dist/views/admin.hbs 0000777 0000000 0000000 00000001625 00000000000 011607 0000000 0000000 <!DOCTYPE html>
<html>
<head>
<title>vm-calc | admin</title>
<link rel="stylesheet" href="https://cdn.simplecss.org/simple.min.css" />
</head>
<body>
<header>
<nav>
<a href="/">Home</a>
<a href="/admin">Admin</a>
</nav>
<h1>vm-calc | admin</h1>
<p>Log into the admin account here.</p>
</header>
<main>
<h4>Login:</h4>
{{#if error}}
<p>Error: {{error}}</p>
{{/if}}
{{#if flag}}
<p>Flag: {{flag}}</p>
{{/if}}
<form method="POST" id="form">
<input name="user" placeholder="Username" />
<input name="pass" placeholder="Password" />
<input type="submit" />
</form>
</main>
</body>
</html> dist/views/index.hbs 0000777 0000000 0000000 00000001514 00000000000 011623 0000000 0000000 <!DOCTYPE html>
<html>
<head>
<title>vm-calc</title>
<link rel="stylesheet" href="https://cdn.simplecss.org/simple.min.css" />
</head>
<body>
<header>
<nav>
<a href="/">Home</a>
<a href="/admin">Admin</a>
</nav>
<h1>vm-calc</h1>
<p>A simple and very secure online calculator!</p>
</header>
<main>
<h4>Enter math expression here:</h4>
<form method="POST" id="form">
<input name="calc" placeholder="1 + 1" style="width: 100%" autocomplete="off" />
<input type="submit" value="Calculate" />
</form>
{{#if result}}
<p>Result: {{result}}</p>
{{/if}}
</main>
</body>
</html>