Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/msoap/shell2http
HTTP-server to execute shell commands. Designed for development, prototyping or remote control. Settings through two command line arguments, path and shell command.
shell2http [options] /path "shell command" /path2 "shell command2" ...
options:
-host="host" : host IP for http server (default bind to all interfaces)
-port=NNNN : port for http server, 0 - to receive a random port (default 8080)
-form : parse query into environment vars, handle uploaded files
-form-check : regexp for check form fields (pass only vars that match the regexp)
-cgi : run scripts in CGI-mode:
- set environment variables with HTTP-request information
- write POST|PUT|PATCH-data to script STDIN (if is not set -form)
- parse headers from script (eg: "Location: URL\n\n")
-export-vars=var : export environment vars ("VAR1,VAR2,...")
by default export PATH, HOME, LANG, USER, TMPDIR
-export-all-vars : export all current environment vars
-no-index : don't generate index page
-add-exit : add /exit command
-log=filename : log filename, default - STDOUT
-shell="shell" : shell for execute command, "" - without shell (default "sh")
-cache=N : caching command out for N seconds
-one-thread : run each shell command in one thread
-show-errors : show the standard output even if the command exits with a non-zero exit code
-include-stderr : include stderr to output (default is stdout only)
-500 : return 500 error if shell exit code != 0
-cert=cert.pem : SSL certificate path (if specified -cert/-key options - run https server)
-key=key.pem : SSL private key path
-basic-auth="" : setup HTTP Basic Authentication ("user_name:password"), can be used several times
-timeout=N : set timeout for execute shell command (in seconds)
-no-log-timestamp : log output without timestamps
-version
-help
In the -form
mode, variables are available for shell scripts:
http://localhost:8080/path?NNN=123
)<input type=file name=ID>
, temporary uploaded file will be automatically deletedWith -form-check
option you can specify the regular expression for checking the form fields.
For example, if you want to allow only variables that contain the only digits,
you can specify the following option: -form-check='^[0-9]+$'
.
Then only requests like http://localhost:8080/path?NNN=123
will be produce variable $v_NNN
.
To setup multiple auth users, you can specify the -basic-auth
option multiple times.
The credentials for basic authentication may also be provided via the SH_BASIC_AUTH
environment variable.
You can specify the preferred HTTP-method (via METHOD:
prefix for path): shell2http GET:/date date
MacOS:
brew install msoap/tools/shell2http
# update:
brew upgrade shell2http
Download binaries from: releases (MacOS/Linux/Windows/RaspberryPi)
For Docker users, availeble tags see in Docker Hub:
docker pull msoap/shell2http
Using snap (Ubuntu or any Linux distribution with snap):
# install stable version:
sudo snap install shell2http
# install the latest version:
sudo snap install --edge shell2http
# update
sudo snap refresh shell2http
Notice: the snap-package has its own sandbox with the /bin
, /usr/bin
directories which are not equal to system-wide PATH
directories
and commands may not work as expected or not work at all.
Build from source (minimum Go version is 1.12):
go install github.com/msoap/shell2http@latest
# set link to your PATH if needed:
ln -s $(go env GOPATH)/bin/shell2http ~/bin/shell2http
Compile for MIPS CPU (for example, for some WiFi routers like Asus):
GOOS=linux GOARCH=mipsle GOMIPS=softfloat go build -trimpath -ldflags="-w -s" -o shell2http .
shell2http /top "top -l 1 | head -10"
shell2http /date date /ps "ps aux"
shell2http -export-all-vars /env 'printenv | sort' /env/path 'echo $PATH' /env/gopath 'echo $GOPATH'
shell2http -export-all-vars /shell_vars_json 'perl -MJSON -E "say to_json(\%ENV)"'
shell2http -export-vars=GOPATH /get 'echo $GOPATH'
shell2http /cal_html 'echo "<html><body><h1>Calendar</h1>Date: <b>$(date)</b><br><pre>$(cal $(date +%Y))</pre></body></html>"'
shell2http -form /form 'echo $v_from, $v_to'
shell2http -cgi /user_agent 'echo $HTTP_USER_AGENT'
shell2http -cgi /set 'touch file; echo "Location: /another_path\n"' # redirect
shell2http -cgi /404 'echo "Status: 404"; echo; echo "404 page"' # custom HTTP code
shell2http -form \
GET:/form 'echo "<html><body><form method=POST action=/file enctype=multipart/form-data><input type=file name=uplfile><input type=submit></form>"' \
POST:/file 'cat $filepath_uplfile > uploaded_file.dat; echo Ok'
Testing upload file with curl:
curl -i -F uplfile=@some/file/path 'http://localhost:8080/file'
shell2http -log=/dev/null -cgi / 'echo $REQUEST_URI 1>&2; [ "$REQUEST_METHOD" == "POST" ] && post_param="-d@-"; curl -sL $post_param "$REQUEST_URI" -A "$HTTP_USER_AGENT"'
shell2http -form /slow 'sleep ${v_duration:-1}; echo "sleep ${v_duration:-1} seconds"'
shell2http -form \
/form 'echo "<html><form action=/get>URL: <input name=url><input type=submit>"' \
/get 'MD5=$(printf "%s" $v_url | md5); cat cache_$MD5 || (curl -sL $v_url | tee cache_$MD5)'
shell2http /get 'osascript -e "output volume of (get volume settings)"' \
/up 'osascript -e "set volume output volume (($(osascript -e "output volume of (get volume settings)")+10))"' \
/down 'osascript -e "set volume output volume (($(osascript -e "output volume of (get volume settings)")-10))"'
shell2http /play_pause 'osascript -e "tell application \"Vox\" to playpause" && echo ok' \
/get_info 'osascript -e "tell application \"Vox\"" -e "\"Artist: \" & artist & \"\n\" & \"Album: \" & album & \"\n\" & \"Track: \" & track" -e "end tell"'
shell2http /img 'cat "$(ls "/Library/Desktop Pictures/"*.jpg | ruby -e "puts STDIN.readlines.shuffle[0]")"' \
/wallpapers 'echo "<html><h3>OS X Wallpapers</h3>"; seq 4 | xargs -I@ echo "<img src=/img?@ width=500>"'
curl "http://some-service/v1/call1" > 1.json
shell2http -cgi /call1 'cat 1.json' /call2 'echo "Content-Type: application/json\n"; echo "{\"error\": \"ok\"}"'
Returns value of var
for run in Windows cmd
(http://localhost:8080/test?var=value123
)
shell2http.exe -form /test "echo %v_var%"
Send custom HTTP headers:
shell2http -cgi / 'echo "Content-Type: application/javascript\n"; echo "{\"error\": \"ok\"}"'
On Windows:
shell2http.exe -cgi / "echo Content-Type: application/javascript& echo.& echo body"
Example of test.Dockerfile
for server for get current date:
FROM msoap/shell2http
# may be install some alpine packages:
# RUN apk add --no-cache ...
CMD ["/date", "date"]
Build and run container:
docker build -f test.Dockerfile -t date-server .
docker run --rm -p 8080:8080 date-server
Run https server:
shell2http -cert=./cert.pem -key=./key.pem ...
Generate self-signed certificate:
go run $(go env GOROOT)/src/crypto/tls/generate_cert.go -host localhost
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.