One Hat Cyber Team

Edit File: cgi-node

#!/bin/env node
var CgiNodeConfig={Version:"0.2",StartTag:"<?",EndTag:"<?",ScriptExtensions:[".js"],EmbededScriptExtensions:[".jss"],SessionCookie:"CGI-NODE-SESSIONID",SessionTimeOut:900,SessionPath:"D:/Programs/nodejs/sessions/"};
function CgiHttpContext(a){var b=this;this.__scripts=[];this.__vmContext=null;this.request=new CgiHttpRequest(a);this.response=new CgiHttpResponse;this.session=new CgiHttpSession(this.request,this.response);this.write=this.response.write;this.process=process;this.require=require;this.mapPath=function(a){return a};this.include=function(a,d){void 0===d&&(d={encoding:"utf8"});var e=b.mapPath(a),g=FS.readFileSync(e,d);script=".js"!=Path.extname(a)?CgiParser.script(b.__scripts.length,e,g.toString()):{id:b.__scripts.length,
path:e,script:null,code:g,content:[]};b.__scripts.push(script);null===b.__vmContext&&(b.__vmContext=VM.createContext(b));VM.runInContext(script.code,b.__vmContext,script.path)};this.CgiNodeInfo=function(){var a=function(a,d){b.response.write('<tr><th colspan="2">'+a+"</th></tr>");for(var c in d){var f=d[c];if("function"!==typeof f){if("object"===typeof f){var k='<table class="NodeASPTable" border="0" style="margin: 0px">',l;for(l in f)k+="<tr><td>"+l+"</td><td>"+f[l]+"</td></tr>";f=k+"</table>"}process.stdout.write("<tr><td>"+
c+"</td><td>"+f+"</td></tr>")}}};b.response.write("<style>.NodeASPTable{ font-family: arial; font-size: 12px; margin: auto; border-collapse: collapse; width: 600px} .NodeASPTable TH{ background-color: #303030; color: white; font-size: 14px; padding: 10px} .NodeASPTable TD{ padding: 5px; } .NodeASPTable TR TD:nth-child(1){ background: #d9ebb3; }</style>");b.response.write('<table class="NodeASPTable" border="1">');var d={id:b.session.id,path:b.session.path,ipAddress:b.session.ipAddress};a("CGI Command Line Arguments",
process.argv);a("Server Variables",b.request.server);a("HTTP Request Headers",b.request.headers);a("HTTP Request Cookies",b.request.cookies);a("Session",d);a("Session Cookies",b.session.cookies);a("Session Data",b.session.data);a("URL Query String",b.request.query);a("Post Form",b.request.post.form);a("Post Files",b.request.post.files);a("Post Parts",b.request.post.parts);b.response.write("</table>")}}
function CgiHttpSession(a,b){var c=this;this.ipAddress=this.path=this.id=null;this.cookies={};this.data={};this.init=function(){a.session=this;b.session=this;this.id=a.cookies.hasOwnProperty(CgiNodeConfig.SessionCookie)?a.cookies[CgiNodeConfig.SessionCookie]:this.create();var d=Path.join(CgiNodeConfig.SessionPath,this.id);FS.existsSync(d)||(this.id=this.create());d=JSON.parse(FS.readFileSync(Path.join(CgiNodeConfig.SessionPath,this.id)));if(d.ipAddress!=a.server.remote_addr)throw"Invalid session ID!";
for(name in d)this[name]=d[name]};this.save=function(){FS.writeFileSync(c.path,JSON.stringify({id:c.id,path:c.path,ipAddress:c.ipAddress,cookies:c.cookies,data:c.data}))};this.create=function(){var b=a.server.remote_addr+a.server.remote_port+a.server.unique_id+(new Date).value+Math.random(),b=Crypto.createHash("md5").update(b).digest("hex"),c={id:b,path:Path.join(CgiNodeConfig.SessionPath,b),ipAddress:a.server.remote_addr,cookies:{},data:{}};c.cookies[CgiNodeConfig.SessionCookie]={name:CgiNodeConfig.SessionCookie,
value:b,httpOnly:!0,notSent:!0,server:!0};FS.writeFileSync(c.path,JSON.stringify(c));return c.id};this.cleanUp=function(){for(var a=(new Date).value,b=1E3*CgiNodeConfig.SessionTimeOut,c=FS.readdirSync(CgiNodeConfig.SessionPath),h=0;h<c.length;h++){var f=Path.join(CgiNodeConfig.SessionPath,c[h]);FS.statSync(f).mtime.value+b<a&&FS.unlinkSync(f)}};this.init()}
function CgiHttpResponse(){var a=this;this.session=null;this.isHeaderSent=!1;this.headers={"content-type":"text/html; charset=iso-8859-1"};this.sendHeaders=function(){if(!a.isHeaderSent){a.isHeaderSent=!0;for(var b in a.headers)process.stdout.write(b+":"+a.headers[b]+"\r\n");for(b in a.session.cookies){var c=a.session.cookies[b];!0===c.notSent&&(delete c.notSent,process.stdout.write("Set-Cookie:"+CgiParser.serializeCookie(c)+"\r\n"))}process.stdout.write("\r\n")}};this.write=function(b){a.sendHeaders();
process.stdout.write(b.toString())};this.end=function(){a.sendHeaders();process.exist()}}
function CgiHttpRequest(){var a=this;this.httpVersion=this.method=this.url=null;this.query={};this.post={form:{},files:[],parts:[],data:"",isMultiPart:!1};this.server={};this.headers={};this.cookies={};this.form={};this.init=function(){CgiParser.enviromentVarialbesAndHeaders(process.env,this.server,this.headers);this.method=this.server.request_method;this.httpVersion=this.server.server_protocol;this.headers.content_type=this.server.hasOwnProperty("content_type")?this.server.content_type:"";this.headers.content_length=
this.server.hasOwnProperty("content_length")?this.server.content_length:0;this.headers.hasOwnProperty("cookie")&&(this.cookies=CgiParser.cookies(this.headers.cookie));this.url=URL.parse(this.server.request_uri,!0);this.query=this.url.query;a.post.isMultiPart=-1<this.headers.content_type.toLowerCase().indexOf("multipart/form-data")};this.readPost=function(b,c){void 0===c&&(c=!0);process.stdin.on("data",function(b){a.post.data+=b});process.stdin.on("end",function(){c&&a.parsePost();b&&b()})};this.parsePost=
function(){a.post.isMultiPart?CgiParser.multiPart(a.post.data,a.post):a.post.form=QueryString.parse(a.post.data)};this.init()}
var CgiParser={script:function(a,b,c){var d="response.write( __scripts["+a+"].content[";a={id:a,path:b,code:"",content:[]};for(var e=b=0;b<c.length;)if(b=c.indexOf("<?",e),0<=b){b>e&&(a.code+=d+a.content.length+"]);",a.content.push(c.slice(e,b)));var e=b+2,g="="==c[e]?e++:-1;b=c.indexOf("?>",e);if(0<=b)a.code=0<g?a.code+("response.write( "+c.slice(e,b)+" ); "):a.code+(c.slice(e,b)+";"),e=b+2;else throw Error("Missing close tag ?>");}else b=c.length,a.code+=d+a.content.length+"]);",a.content.push(c.slice(e,
b));return a},enviromentVarialbesAndHeaders:function(a,b,c){for(var d in a){var e=a[d];d=d.toLowerCase();0===d.indexOf("http_")?c[d.substring(5)]=e:b[d]=e}},multiPart:function(a,b){void 0===b&&(b={form:{},files:{},parts:[]});var c=0,c=a.indexOf("\n"),c=a.substring(0,c-1);b.parts=a.split(c);for(c=0;c<b.parts.length;c++);return b},serializeCookie:function(a){var b=[a.name+"="+encodeURIComponent(a.value)];a.domain&&b.push("Domain="+a.domain);a.path&&b.push("Path="+a.path);a.expires&&b.push("Expires="+
a.expires.toUTCString());a.httpOnly&&b.push("HttpOnly");return b.join("; ")},cookies:function(a){a=a.split(";");for(var b={},c=0;c<a.length;c++){var d=a[c],e=d.indexOf("=");if(!(0>e)){var g=d.substr(0,e).trim(),d=d.substr(e+1,d.length).trim();'"'==d[0]&&(d=d.slice(1,-1));try{b[g]=decodeURIComponent(d)}catch(h){b[g]=d}}}return b}},VM=require("vm"),FS=require("fs"),URL=require("url"),Path=require("path"),Crypto=require("crypto"),QueryString=require("querystring"),cgiNodeContext=null;
process.on("uncaughtException",function(a){a='<br/><div style="color:red"><b>EXCEPTION</b>: '+a.message+"<i><pre>"+a.stack+"</pre></i></div></br>";null!==cgiNodeContext?cgiNodeContext.response.write(a):process.stdout.write("Content-type: text/html; charset=iso-8859-1\n\n"+a)});process.on("exit",function(a){cgiNodeContext.session.save();cgiNodeContext.session.cleanUp()});var cgiNodeContext=new CgiHttpContext,onReady=function(){cgiNodeContext.include(process.env.PATH_TRANSLATED)};
cgiNodeContext.request.method="GET";"POST"!=cgiNodeContext.request.method?onReady():cgiNodeContext.request.readPost(onReady);