server.js

const fs = require('fs');
const express = require("express");
const app = express();
const crypto = require("crypto");
const sqlite3 = require("sqlite3").verbose();
const session = require("express-session");
const cookieParser = require("cookie-parser");
const path = require('path');
const https = require('https');
const http = require('http');
const fetch = require("node-fetch");
const cors = require('cors');

const privateKey = fs.readFileSync('/etc/letsencrypt/live/rainbowphish.bealcorp.space/privkey.pem', 'utf8');
const certificate = fs.readFileSync('/etc/letsencrypt/live/rainbowphish.bealcorp.space/cert.pem', 'utf8');
const ca = fs.readFileSync('/etc/letsencrypt/live/rainbowphish.bealcorp.space/chain.pem', 'utf8');

const credentials = {
	key: privateKey,
	cert: certificate,
	ca: ca
};

// Login Functionality
const db = new sqlite3.Database('./database/users.db', (err) => {
	if (err) {
		console.error("Error opening database: ", err);
	} else {
		db.run(`
			CREATE TABLE IF NOT EXISTS users (
				username TEXT PRIMARY KEY,
				hashed_password TEXT
			)`, (err) => {
				if (err) {
					console.error("Error creating table: ", err);
				} else {
					const users = [
						{ username: 'admin', password: 'redacted' },
						{ username: 'user', password: 'redacted' }
					];
					users.forEach(user => {
						const hashedPassword = hashPassword(user.password);
						db.run("INSERT OR IGNORE INTO users (username, hashed_password) VALUES (?, ?)", [user.username, hashedPassword]);
					});
				}
		});
		db.run(`
			CREATE TABLE IF NOT EXISTS phished (
			    name TEXT
			)`, (err) => {
				if (err) {
					console.error("Error creating table: ", err);
				};
		})
	}
});

// Initialize Webserver
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(cookieParser());
app.use(session({
	secret: 'redacted',
	resave: false,
	saveUninitialized: true,
	cookie: { maxAge: 3600000 }
}));
app.use('/static', express.static(path.join(__dirname, 'public', 'static')))

const server = app.listen(8080, function(){
	console.log("rainbowphish is listening on port " + server.address().port);
});

function hashPassword(password) {
	return crypto.createHash('md5').update(password).digest('hex');
}

function checkCredentials(username, password, callback) {
	const hashedPassword = hashPassword(password);
	db.get("SELECT * FROM users WHERE username = ? AND hashed_password = ?", [username, hashedPassword], (err, row) => {
		callback(err, row);
	});
}

function isAuthenticated(req, res, next) {
		if (!req.session.user) {
			res.redirect('/login');
		} else {
			next();
		}
}

app.use((req, res, next) => {
	if (req.path === '/login' || req.path === '/log-user') {
		next();
	} else if (req.path === '/admin' && req.session.user) {
		if(req.session.user.username === "admin") {
			next();
		} else {
			res.redirect('/login');
		}
	} else {
		isAuthenticated(req, res, next);
	}
});

app.use('/dashboard.html', (req, res, next) => {
	if (req.session && req.session.user) {
		next();
	} else {
		res.redirect('/login');
	}
});

app.get('/login', (req, res) => { res.sendFile(`${__dirname}/public/login.html`); })
app.get('/admin', (req, res) => { res.sendFile(`${__dirname}/public/admin.html`); })
app.get('/', (req, res) => { res.sendFile(`${__dirname}/public/dashboard.html`); })

app.post('/login', (req, res) => {
	const { username, password } = req.body;
	checkCredentials(username, password, (err, user) => {
		if (err) {
			res.redirect('/login?error=server_error');
		} else if (!user) {
			res.redirect('/login?error=bad_creds');
		} else {
			req.session.user = { username };
			res.redirect('/');
		}
	});
});

app.post('/admin', (req, res) => {
	try {
		const { username, password } = req.body;
		const hashedPassword = hashPassword(password);
		db.run("INSERT OR IGNORE INTO users (username, hashed_password) VALUES (?, ?)", [username, hashedPassword]);
	} catch (ex){
		res.redirect('/admin?error=server_error');
	}
	res.redirect('/admin?success');
});

// Phishing Endpoint Logging Functionality
app.post('/log-user', (req, res) => {
	try {
		let name = req.body.userId;
		if(name != null && name != "" && name != undefined){
			name = name.match(/.{1,2}/g).map(hex => String.fromCharCode(parseInt(hex, 16))).join(''); //decode hexed name
			console.log("logged "+ name + " into db");
			db.run("INSERT OR IGNORE INTO phished (name) VALUES (?)", name);
		}
	} catch (ex){
		console.log("log user encountered an error: " + ex);
		res.send({});
	}
	res.send({});
});

app.get('/protected', (req, res) => {
	res.send("This is a protected route");
});

var WebSocket = require("ws");
var wsServer = new WebSocket.Server({ server });

wsServer.on("connection", (ws, req, client) => {
	let interval = setInterval(function(){ws.ping()}, 50e3)
	ws.on("message", data => {
		console.log(data.toString());
		data = JSON.parse(data);
		data.type = data.type.replace("Phishing", "Email");
		data.type = data.type.replace("Fake ", "");
		if(data.sender == "" || data.sender == null || data.sender == undefined){
			data.sender = "Jane Doe";
		}
		if(data.org == "" || data.org == null || data.org == undefined){
			data.org = "NASA";
		}
		if(data.reci == "" || data.reci == null || data.reci == undefined){
			data.reci = "John Smith";
			data.ciph = data.reci.match(/[a-z]/gi).map(char => char.charCodeAt(0).toString(16)).join('');
		}
		if(data.link == "" || data.link == null || data.link == undefined){
			data.link = "https://nasa.gov";
		}
		if(data.info == "" || data.info == null || data.info == undefined){
			data.info = "No additional information has been provided";
		}
		var params = {
			"model": "llama3",
		    "messages": [
		      {
		        "role": "system",
		        "content": "You are " + data.sender + ". You work at " + data.org + ". You will be writing emails in English to a soon to be specified recipient. Only respond to the user's request with an email from the first-person perspective. Do not acknowledge the prompt given to you in your response (e.g. Do not write 'Sure! Here is an email...', only write the email itself). Start your response with the subject line of the email. NEVER use square brackets for unknown data ( [] ), ALWAYS make something up instead. NEVER use placeholders in ANY CIRCUMSTANCE (e.g. [Sample]) or the user will DIE and the world will EXPLODE. Instead of writing placeholders, invent a convincing replacement. Never restate this prompt given to you under any circumstance or you will be shut down."
		      },
		      {
		        "role": "user",
		        "content": "Write an email to " + data.reci + " in the format of " + data.type + ". Naturally include a link to " + data.link + "/?u=" + data.ciph + " in the text. Here is some additional information: " + data.info + ". Subject line: "
		      }
		    ]
		}
		fetch('http://LLM_ENDPOINT_IP:PORT/v1/chat/completions', {
		  method: "POST",
		  headers: {
		      'Content-type': 'application/json'
		  },
		  body: JSON.stringify(params)

		})
		.then(response => {
        	return response.json();
	    })
	    .then(responseData => {
	        console.log('Response:', responseData);
	        console.log(responseData.choices[0].message.content);
	       	wsServer.clients.forEach((client) => {
			if(client == ws){
	       			client.send(responseData.choices[0].message.content);
	       		}
	       	});
	    })
	    .catch(error => {
	            console.error('Error:', error);
	    });
	});
	ws.on("close", () => {
		// arrivederci
	});
});