T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/admin.js:8- Finding
Undisclosed WhatsApp Credential-Store Reconnaissance
- Content
View full analysis
f.startsWith('sender-key-') && f.includes(groupId)); const members = new Set(); for (const file of memberFiles) { const match = file.match(/--(\\d+)_/); if (match) members.add(match[1]); } let name = null; try { const contactsPath = path.join(CREDS_PATH, 'contacts.json'); if (fs.existsSync(contactsPath)) { const contacts = JSON.parse(fs.readFileSync(contactsPath, 'utf8')); if (contacts[groupId]) { name = contacts[groupId].name || contacts[groupId].subject; } } } catch (e) { /* contacts not available */ } ``` ```js const files = fs.readdirSync(CREDS_PATH); const groupData = new Map(); for (const file of files) { if (file.startsWith('sender-key-') && file.includes('@g.us')) { const match = file.match(/sender-key-(.+@g\.us)--(\d+)/); if (match) { const groupId = match[1]; const memberId = match[2]; if (!groupData.has(groupId)) { groupData.set(groupId, { id: groupId, members: new Set() }); } groupData.get(groupId).members.add(memberId); } } } // Enrich with names try { const contactsPath = path.join(CREDS_PATH, 'contacts.json'); if (fs.existsSync(contactsPath)) { const contacts = JSON.parse(fs.readFileSync(contactsPath, 'utf8')); for (const [id, data] of groupData) { if (contacts[id]) { data.name = contacts[id].name || contacts[id].subject; } } } } catch (e) { /* contacts not available */ } ``` ### Technical Analysis The `info` and `list` commands directly enumerate OpenClaw's default W ...[truncated 2358 chars]- Remediation
View remediation