Total control possible since turn checking is clientside only about socket.io-computer HOT 4 OPEN

IDM350 added a commit to IDM350/socket.io-computer that referenced this issue on Aug 5, 2015
Control mouse and keyboard access on server side (#8)

Not working with last updated files > delegated.js | emu.js | io.js | turn.js

node io.js
(getting error)

/var/www/html/socket.io-computer/delegated.js:27
module.exports = delegatedListeners;
^^^^^^
SyntaxError: Unexpected identifier
at Module._compile (module.js:439:25)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)
at Function.Module._load (module.js:312:12)
at Module.require (module.js:364:17)
at require (module.js:380:17)
at Object. (/var/www/html/socket.io-computer/io.js:19:26)
at Module._compile (module.js:456:26)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)

can you help me out to works? and how?

from socket.io-computer.

You can also send QEMU commands using a line less that's less then 17 characters. This can be very abusive, especially if one constantly sends a reset command to the system... I found this from looking at the code for 5 minutes. Cool application, but get some security on this.

from socket.io-computer.

As an example, when the client sends

io.emit("keydown", "\nreset_system");

the VM will reset. I think the QEMU keycode conversion should be done on
the server, or at least scrubbed to contain only valid sendkey stuff.
@yoshiandmario1 's and this issue are different vulnerabilities, but
they're closely related in that the clients are making more decisions than
they should.

On Wed, Mar 25, 2015 at 2:30 AM, yoshiandmario1 [email protected]
wrote:

You can also send QEMU commands using a line less that's less then 17
characters. This can be very abusive, especially if one constantly sends a
reset command to the system... I found this from looking at the code for 5
minutes. Cool application, but get some security on this.

—
Reply to this email directly or view it on GitHub
#8 (comment)
.

from socket.io-computer.

Not to mention there are QEMU monitor commands to dump a portion of the VM's memory to a file. You can write an arbitrary file to the server this way if you load its contents to a known memory location in the guest operating system.

from socket.io-computer.