hacktracking: nodejs

Showing posts with label nodejs. Show all posts

# Socket.io chat

# cat chat.io
var http = require('http');
var fs = require('fs');
var url = require('url');

var nicknames_list = [];
var ip_address = '192.168.1.1'
var port = 1234
var socketio_path = '/usr/local/lib/node_modules/socket.io'
var index_path = '/index.html'
var jquery_path = '/jquery.min.js'
var css_path = '/style.css'
var encoding = 'utf-8'

var server = http.createServer(function (req, res){
 var pathname = url.parse(req.url).pathname;
 if(pathname === '/'){
  fs.readFile('.' + index_path, function (err, data){
   res.writeHead(200, {'content-type': 'text/html'});
   res.end(data, encoding);
  });
 }else if(pathname === jquery_path){
  fs.readFile('.' + jquery_path, function (err, data){
   res.writeHead(200, {'content-type': 'application/javascript'});
   res.end(data, encoding);
  });
 }else if(pathname === css_path){
  fs.readFile('.' + css_path, function (err, data){
   res.writeHead(200, {'content-type': 'text/css'});
   res.end(data, encoding);
  });
 }
}).listen(port, ip_address);

var io = require(socketio_path).listen(server);

io.sockets.on('connection', function (socket){

 socket.on('nickname', function (data, callback){
  if(nicknames_list.indexOf(data) !== -1){
   callback(false);
  }else{
   callback(true);
   nicknames_list.push(data);
   socket.nickname = data;
   console.log('Nickname list: ' + nicknames_list);
   io.sockets.emit('nicknames_list', nicknames_list);
  }
 });

 socket.on('message', function (data){
  io.sockets.emit('message', {nickname: socket.nickname, message: data});
 });

 socket.on('disconnect', function (){
  if(!socket.nickname) return;
  var index = nicknames_list.indexOf(socket.nickname);
  if(index > -1){
   nicknames_list.splice(index, 1);
  }
  console.log('Nickname list: ' + nicknames_list);
  io.sockets.emit('nicknames_list', nicknames_list);
 });

});
# cat index.html
<!DOCTYPE html>
<html lang="en">
 <head>
  <meta charset='utf-8'>
  <title>chat.io</title>
  <link rel='stylesheet' type='text/css' href='style.css'>

  <script src='/jquery.min.js'></script>
  <script src='/socket.io/socket.io.js'></script>

  <script>
   var host = '192.168.1.1';
   var port = '1234';
   var socket = io.connect('http://' + host + ':' + port);
   jQuery(function ($){

    var nickname = $('#nickname');
    var nickname_form = $('#nickname_form');
    var nicknames_list = $('#nicknames_list');
    var message = $('#message');
    var message_ml = $('#message_ml');
    var message_form = $('#message_form');
    var message_ml_form = $('#message_ml_form');
    var messages_list = $('#messages_list');

    nickname_form.submit(function (event){
     event.preventDefault();
     socket.emit('nickname', nickname.val(), function (data){
      if(data){
       nickname_form.hide();
       nicknames_list.show();
       message_form.show();
       message_ml_form.show();
       messages_list.show();
      }else{
       nickname_form.prepend('<p>Sorry, the nickname is taken.</p>');
      }
     });
    });

    message_form.submit(function (event){
     event.preventDefault();
     if(message.val() !== ''){
      socket.emit('message', message.val());
      message.val('').focus();
     }
    });

    message_ml_form.submit(function (event){
     event.preventDefault();
     if(message_ml.val() !== ''){
      socket.emit('message', message_ml.val());
      message_ml.val('').focus();
     }
    });

    socket.on('nicknames_list', function (data){
     var nl = '';
     for(var i = 0; i < data.length; i++){
      nl += '<li>[' + data[i] + ']</li>';
     }
     nicknames_list.empty().append(nl);
    });

    socket.on('message', function(data){
     messages_list.val(messages_list.val() + '\n[' + data.nickname + '] ' + data.message);
     messages_list.scrollTop(messages_list[0].scrollHeight - messages_list.height());
    });

   });
  </script>
 </head>
 <body>
  <div id='top'>
   <div id='title'>chat.io</div>
  </div>
  <div id='center'>
   <div id='right'>
    <section id='nicknames_list'>
     <ul></ul>
    </section>
   </div>

   <div id='left'>
    <form id='nickname_form'>
     <input type='text' id='nickname' placeholder='<Enter your nickname>'>
     <button type='submit'>Submit</button>
    </form>

    <textarea id='messages_list' readonly></textarea>

    <form id='message_form'>
     <input type='text' id='message' placeholder='<Send single line>'></input>
     <button type='submit'>Send</button>
    </form>

    <form id='message_ml_form'>
     <textarea id='message_ml' placeholder='<Paste multiline>'></textarea>
     <button type='submit'>Paste</button>
    </form>
   </div>
  </div>
 </body>
</html>
# cat style.css
html {
 background: #000;
 color: #575;
 font-family: monospace;
 font-size: 12px;
 margin: 0;
 padding: 0;
}

input, button, textarea {
 background: #000;
 border: 1px solid #575;
 color: #575;
 font-family: monospace;
 font-size: 12px;
 margin-bottom: 10px;
 padding-left: 5px;
}

#top {
 width: 100%;
}

#center {
 width: 100%;
}

#left {
 width: 80%;
}

#right {
 float: right;
 width: 20%;
}

#title {
 font-size: 30px;
}

#nickname {
 width: 90%;
}

#message_form, #message_ml_form {
 display: none;
}

#message, #message_ml {
 width: 90%;
}

#messages_list{
 display: none;
 height: 400px;
 width: 90%;
}

#nicknames_list {
 display: none;
 list-style-type: none;
}
# nodejs chat.io
   info  - socket.io started

# NcN CTF 2k13: Algeria (Base - 900 pts)

# echo -n '425a6839314159265359d77d47c600ca357b84e810004070edfd1a082a7fffff2b0000800860083deaf9428555294ad51a5512b4c5365ef11200000000000003410a8cca604668004600000261800068000c9a00000d008554432680d00680034000009a95289ea651a6046d09b4098200c4c01494a6a6940007a806806400007b7b65fec32018b455437f94574ce0c6e89aa40860733f66a6430f6393e3b9dd7cfcbb7d5d7d1cba38eae3a82257a278eb6d36b6b28894a68696858a96a82a95b028c2e26db6844d60d3359ab6b69ad8d95c5ca5aa71a6138a63566da9031018a2d34d929b52b6663260db6aada6cb30cd0438b1049b5559f0299840c94ca9b2ca6ad121a2c26aacd0acc451b4954d343480cb6a9acc622b8ec413d4efdfbff7bbc52354d0a17286a4abf2db616465828b89b10187a3f6f2a9d9bd3a191caa1e2ef2e101cc8b534a8e25354754d491e1f8fa3b97878d4e5324e34bfcf36e240bb2ad09d66db136ccad904b652862d0952ccae96e1616b0b8a5ac8d36d444d81b3656c0352b232b22cd2ad5b6b012b2b22b6d4a62336ab29b0d52c62cc593068b65616b48b26db6d56a9b66d59b5b034b2526616c555caab394495db006d990aeccb0b4a25c615c7358e01cd85b2d956d4660a198a16c50da27246900e2ca90b8c9473556d0a2ada2bb95288c24985cf60d6b32d6a9a594dac406436b6ac11954a30b4c834cab699298db4a564c4dad6b588da9b26a018a6aa985b199a992d531294932d44910814b304c80d02936564866881acda0c6698a81294a02cc44030af363c9b3eb97ab8f8c1cfb83aeb75e7ebae9e7faf77ebeade3ce77edbc7cdeef967acf65d787c20f0536454b36c0d998ab35503686ccd84795550e50f22034b0b5511cd49aa33446c09a8d66a24ca321598596cb535880d890d95b4226cdac8a971252c9153c38054b06a6aab416b22a58a29ad121d2a34924728aae0918ba701570495855cd785550e2205c06a5266ab9491ca1c35550d5017800ec6da6c98aa5649a24334a3166a84b96d8a970256d22534c852cdadac284b5052b56a922d0c4a596a36998c46a98ad98d532d25acb2ad1416916a98165491a14856aa942205002a61668566162d69534ad0c2d16295aca455b0616126c36141929ab5325986832159223101859252c2329b42c9332a8d0834daab4b02c84ad858b16d3584ac8d6b55a180655a86d5546b150655894d2d06d294c90306696ca505050c2b2a349144a4c440aa56ac064d16cb62b2daa1a2d628c5915ad5604cacc952d9828955408519500071631e1f7c1f867f11d2f076331f1821e0db0604cc0a51e54cd10fe906c2531dc02045520201c25547cd09fa1369c5c29564c3d13b3241deef406acc8c633fe8d450b21c001007e2ee48a70a121aefa8f8c' | xxd -p -r | tar xvjf -
main.js
# grep 'var loginScript' main.js | sed 's/var /exports./' > variable.js
# nodejs
> ls = require('./variable.js');
> eval(ls.loginScript.slice(2,-2));
[ 'if (document.getElementById(\'user_pass\').value === "0f97972a0efd34ebb3111ac8ec6976740529df531e94df14d0ee8614a07d153b") { alert(\'win\'); } else { alert(\'try again\'); }' ]