shell bypass 403

GrazzMean-Shell Shell

Uname: Linux business55.web-hosting.com 4.18.0-553.lve.el8.x86_64 #1 SMP Mon May 27 15:27:34 UTC 2024 x86_64
Software: LiteSpeed
PHP version: 8.1.31 [ PHP INFO ] PHP os: Linux
Server Ip: 162.213.251.212
Your Ip: 18.188.209.215
User: allssztx (535) | Group: allssztx (533)
Safe Mode: OFF
Disable Function:
NONE

name : e-cardHandler.js
const express = require('express');
const router = express.Router();
const User = require('../../schema/User')
const ECard = require('../../schema/E-Card')
const sendMail = require('../email/sendMail')

function capitalizeWords(str) {
    if (typeof str !== 'string') {
        return '';
    }
    return str.replace(/\b\w/g, function (char) {
        return char.toUpperCase();
    });
}

router.post('/', async (req, res) => {
    try {
        const user = req.user
        if (user) {
            const { cardJson, ballzType, recipentName, recipentemail, deliveryDate, senderName, message } = req.body
            const receiver = await User.findOne({ email: recipentemail })
            const sender = await User.findById(user.id);
            console.log('receiver', receiver)
            console.log('sender', sender)
            // if (!receiver) {
            //     return res.status(404).json({ message: `User for ${recipentemail} not Found...` })
            // }
            let card;
            if (receiver) {
                card = await ECard.create({ sender: sender._id, recipentemail, receiver: receiver._id, cardJson, ballzType, recipentName: capitalizeWords(recipentName), deliveryDate, senderName: capitalizeWords(senderName), message })
            } else {
                card = await ECard.create({ sender: sender._id, recipentemail, cardJson, ballzType, recipentName: capitalizeWords(recipentName), deliveryDate, senderName: capitalizeWords(senderName), message })
            }
            return res.status(200).json({ message: `Card Created...`, card })
        }
        return res.status(403).json({ message: `Login to send Card...` })
    } catch (err) {
        console.log(err.message)
        res.status(500).json({ message: err.message })
    }

})
router.post('/delete', async (req, res) => {
    try {
        const user = req.user
        if (user) {
            const { id } = req.body
            card = await ECard.findByIdAndDelete(id)
            return res.status(200).redirect(`/send-now?message=Card Deleted from Draft...`)
        }
        return res.status(403).json({ message: `Login to Delete Card...` })
    } catch (err) {
        console.log(err.message)
        res.status(500).json({ message: err.message })
    }

})
router.put('/', async (req, res) => {
    try {
        const user = req.user
        if (user) {
            const { id, cardJson, ballzType, recipentName, recipentemail, deliveryDate, senderName, message } = req.body
            const receiver = await User.findOne({ email: recipentemail })
            const card = await ECard.findById(id)
            // const card = await ECard.create({ sender: sender._id, receiver: receiver._id, cardJson, ballzType, recipentName, deliveryDate, senderName, message })
            if (receiver) {
                card.receiver = receiver._id;
            } else {
                card.receiver = null;
            }
            // card.email = email;
            card.ballzType = ballzType;
            card.recipentName = recipentName;
            card.deliveryDate = deliveryDate;
            card.message = message;
            card.recipentemail = recipentemail;
            card.senderName = senderName;
            card.cardJson = cardJson;
            await card.save()
            return res.status(200).json({ message: `Card Modified...`, card })
        }
        return res.status(403).json({ message: `Login to send Card...` })
    } catch (err) {
        console.log(err.message)
        res.status(500).json({ message: err.message })
    }

})
router.post('/send', async (req, res) => {
    try {
        const user = req.user
        const { id } = req.body
        if (user) {
            const sender = await User.findById(user.id)
            const card = await ECard.findById(id).populate('receiver').exec()
            if (!card.paid) {
                if (sender.credits < 1) {
                    return res.status(402).json({ message: `You don't have enough Credits...` })
                }
                sender.credits -= 1
                card.paid = true;
                card.scheduled = true;
                await sender.save()
                await card.save()
                const id = card._id
                const email = card.recipentemail
                const to = email
                let tempName;

                if(card.senderName == 'Someone'){
                    tempName = 'An anonymous friend'
                }else{
                    tempName = card.senderName
                }

                const subject = `re: You've received a pair`
                const html = `<table role="presentation"
            style="width: 100%; border-collapse: collapse; border: 0px; border-spacing: 0px; font-family: Arial, Helvetica, sans-serif; background-color: rgb(239, 239, 239);">
                <tbody>
                    <tr>
                        <td align="center" style="padding: 1rem 2rem; vertical-align: top; width: 100%;">
                            <table role="presentation"
                                style="max-width: 600px; border-collapse: collapse; border: 0px; border-spacing: 0px; text-align: left;">
                                <tbody>
                                    <tr>
                                        <td style="padding: 40px 0px 0px;">
                                            <div style="padding: 20px; background-color: rgb(255, 255, 255);">
                                                <div style="color: rgb(0, 0, 0); text-align: left;">
                                                    <img src="https://needapair.com/images/dashboard-logo.png" alt="Company" style="width: 60px;">
                                                    <br>
                                                    <h1 style="margin: 1rem 0">Hello ${card.recipentName}!</h1>
                                                    <p style="padding-bottom: 16px">${tempName} has determined that you need a pair of ballz.</p>
                                                    <p style="padding-bottom: 16px">Click <a href="https://needapair.com/e-card-preview/${id}?email=${email}">Retrieve Ballz</a> to go to needapair.com to preview your card and/or print.</p> 
                                                    <p style="padding-bottom: 16px">Thank you,<br>- Ballmaster</p>
                                                    <p style="padding-bottom: 16px; font-size: 12px">Know someone that needs a pair of balls?<br>Tell them now at needapair.com</p>
                                                </div>
                                            </div>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>
                        </td>
                    </tr>
                </tbody>
            </table>`
                sendMail(to, subject, html, "admin").then(async (success) => {
                    if (success) {
                        card.sent = true;
                        await card.save()
                        console.log(`Card sent to ${to}`)
                        return res.status(200).json({ message: `Card sent to ${to}` })
                    }
                    else {
                        console.log('error mailing ecard')
                    }
                })
            }
        } else {
            return res.status(403).json({ message: `Login to send Card...` })
        }
    } catch (err) {
        console.log(err.message)
        res.status(500).json({ message: err.message })
    }

})

module.exports = router
© 2025 GrazzMean-Shell