.NET Compiler.NET Discord Bot - With live snippet compilation and executions

[.NET] Compiler.NET Discord Bot - With live snippet compilation and executions - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Compiler.NET Discord Bot - With live snippet compilation and executions (/showthread.php?tid=5706339)

Pages: Pages 1 2

Compiler.NET Discord Bot - With live snippet compilation and executions - Barret - Aug 29, 2017

Discord bot that can compile and execute your code snippet live in the channel.

Tutorial

This tutorial is based on Debian but should be simple enough for other distro's as well, i assume you read the thread and seen the requirements.
We need NodeJS, Php, Mono and a unix box in order for this to work, notice that you need to be the admin (root) of the unix box you have.

Preparations

Download the base files from: https://github.com/TheBarret/Compiler.NET and place these in a folder where your bot is going to operate.

Via your discord account you can add a new application which is going to be your bot, if you never done this before i recommend
that you follow these instructions: https://github.com/reactiflux/discord-irc/wiki/Creating-a-discord-bot-&-getting-a-token

This token you finally get after you created it, is the token that is going to be in auth.json from my project files.
So go ahead and edit that config and place your bot's token in there.

Install mono-complete and build-essentials if you haven't already

Code 
sudo apt-get install build-essential

sudo apt-get install mono-complete

Install NodeJS 6.* or NodeJS 8.*

Code 
curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -

sudo apt-get install -y nodejs

Code 
curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -

sudo apt-get install -y nodejs

Install the Discord.JS and Random-id.js
This must be executed INSIDE the directory where you placed the compiler bot files

Code 
npm install --save discord.js

npm install --save random-id

After doing this, we have created the environment to execute and operate your compiler bot.
Confirm the following commands to check everything is in place:

[Image: tQcg9wA.png]

Adjustments

The bot.js file contains config settings that you might want to check out, the functions.php has functions that include keyword filterering.
Most keywords have been setup by me, but if you want to change that make sure you use php regex formats, example:

Lets say you want to block System.Text you would add:

Code 
\bSystem\b\.\bText\b

Adding admins (people you trust...)

The bot.js holds also your admins whitelist, it accepts only discord user id's (not the small one, the large number format).

Code 
var admins        = ['1111111111111111','222222222222222','3333333333333'];

If you done all that we are ready to startup and test it out but whatever you do, DON'T EVER EXECUTE AS ROOT
The bot has a feature that blocks compiles being executed as root, but still, bad practise to run services as root.

So create or change into another (lower) account and type node bot.js in the bot folder we created earlier

[Image: UxYfIZm.png]

Things to consider and facts

Room for improvement, feel free to adjust the scripts if you see fit.

The bot uses two pre-set c#/vb solution files that contain pre-coded wrapper classes.

Compilations are usually finished within 3~6 seconds, depending on system hardware and speed.

The bot keeps session id's that correspond with log files in the log folder that hold more detailed info of a session.

Each user using the bot gets a separated log folder that holds all requests and builds.

The bot uses Framework 4.5, change this by changing the settings when you open the project files in the VS.

Mono might have a lot already built in, a small portion has yet to be ported.

Why CAS is not been utilized? Sadly Mono does not yet support these namespaces.

Commands

!showid Shows user's discord id (everyone)

!uptime Shows system uptime (everyone)

!mem Shows system memory table (everyone)

!version Shows current version along with system's OS info (everyone)

!mono Shows current mono version (everyone)

!chmode Enables or Disables lock for free compiles for non-admins users (only admin, enabled by default)

!vbnet ..code.. Compiles and executes vb.net code (only admins or if lock is disabled)

!csharp ..code.. Compiles and executes c#.net code (only admins or if lock is disabled)

Features

C# Compile and Run

VB Compile and Run

Supports Framework 4.5

Whitelist members only

Safety: filter (intercept potential unsafe code)

Safety: Max execution time

Safety: Max output responds

Safety: Will not compile if process is root

Requirements

Unix server

Mono (runtime and sdk)

Java environment (Node.js, Discord.js)

Php environment (version 5.*)

And...decent knowledgement of all items named above

Diagram of system flow

[Image: iPEwmxI.png]

VB.NET

C#.NET

Some loop testing
[Image: IQ2a7Xt.png?1]

Unix Debug Terminal
[Image: S0ZfNc8.png]

People involved with testing in this project
Panthera (advice, tester), Cawk (advice tester), forceberg (tester), Wops (tester), Naywyn (tester), NewMecha (model), Rhez (tester), Electroalek (php regex)

(if i forgot your name, please forgive me and pm me)

* - Rhez - Aug 29, 2017

What do you fucking expect with Barret's thread? Of course another fucking high quality thread. 😏

* - .cYRil. - Aug 29, 2017

This is really amazing and different share, great job as always.

* - Cecilia - Aug 30, 2017

Fun bot to play with, well done :)

* - warpje - Aug 30, 2017

Wow you always deliver nice and quality projects.
Is the bot on your discord?

* - cawkre - Aug 30, 2017

Very nice bot!
It's a nice feature in a discord server to have fun with

Nice job!

* - Barret - Aug 30, 2017

(Aug 30, 2017 04:13 PM)danny1313 Wrote: Very nice bot!
It's a nice feature in a discord server to have fun with

Nice job!

Oh and they have.... 😑 they trying all fucked up voodoo linq in there....

I had to rewrite a ton of security measures (filters) to avoid pesky info leakage.

* - Helios. - Aug 30, 2017

Great job.

Now regarding security you shouldn't just rely on "filters". You should use sandboxing in .net (CAS policy) and since you are using Unix you can run the proccess under a user with the lowest permissions possible (read/write/execute).

* - Barret - Aug 31, 2017

Ok finally updated the thread, tutorial is made, questions can be asked.

* - Parse - Aug 31, 2017

this is sick good work man i like the organization

* - Niǌa - Aug 31, 2017

I am assuming you blocked people from accessing your PC information and hardware info and such?

This looks nice though, good job.

* - Rhez - Aug 31, 2017

(Aug 31, 2017 04:21 AM)Niǌa Wrote: I am assuming you blocked people from accessing your PC information and hardware info and such?

This looks nice though, good job.

He filtered methods that can have security issue on his side.

* - Niǌa - Aug 31, 2017

(Aug 31, 2017 05:02 AM)Rhez Wrote: He filtered methods that can have security issue on his side.

Ah ok.

And also I hope you blocked CodeDOM.

* - Barret - Aug 31, 2017

The bot is currently offline, some asshole managed to do something and corrupted the filesystem on the SD, so ill have to replace that with a new one, downtime, 3 or 4 days

* - Niǌa - Aug 31, 2017

(Aug 31, 2017 10:35 AM)Barret Wrote: The bot is currently offline, some asshole managed to do something and corrupted the filesystem on the SD, so ill have to replace that with a new one, downtime, 3 or 4 days

There will probably always be exploits. I suggest you get a couple of good guys you know to beta test it some more.