@remnux/mcp-server 0.1.60 → 0.1.61
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,wBAAwB,EAAE,oBAAoB,
|
|
1
|
+
{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,wBAAwB,EAAE,oBAAoB,EAgH1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,eAAe,GACvB,oBAAoB,EAAE,CAIxB"}
|
package/dist/tools/advisories.js
CHANGED
|
@@ -50,6 +50,33 @@ export const POST_ANALYSIS_ADVISORIES = [
|
|
|
50
50
|
"(run_tool command='webcrack <file>'), with js-deobfuscator as a fallback. Retry box-js " +
|
|
51
51
|
"with a longer --timeout only if slow unpacking, rather than anti-emulation, is suspected.",
|
|
52
52
|
},
|
|
53
|
+
{
|
|
54
|
+
name: "box-js-self-relaunch",
|
|
55
|
+
priority: 8,
|
|
56
|
+
shouldApply: (ctx) => {
|
|
57
|
+
if (ctx.category !== "JavaScript")
|
|
58
|
+
return false;
|
|
59
|
+
// box-js reports the sample re-invoking itself via WScript/CScript, using
|
|
60
|
+
// its placeholder constant CURRENT_SCRIPT_IN_FAKED_DIR for the sample path.
|
|
61
|
+
// A self-relaunch is anti-emulation: box-js runs the OUTER script (which
|
|
62
|
+
// only relaunches itself) and never reaches the payload, so it exits cleanly
|
|
63
|
+
// WITHOUT timing out — the box-js-stall advisory does not catch this form.
|
|
64
|
+
return ctx.toolsRun.some((t) => t.name === "box-js" &&
|
|
65
|
+
t.output &&
|
|
66
|
+
/(?:wscript|cscript)(?:\.exe)?[^\n]*CURRENT_SCRIPT_IN_FAKED_DIR/i.test(t.output));
|
|
67
|
+
},
|
|
68
|
+
issue: "box-js observed the script relaunching itself via WScript/CScript (a " +
|
|
69
|
+
"self-referential re-invocation of the sample). This is anti-emulation: the outer " +
|
|
70
|
+
"script only re-launches itself, so box-js deflects and never reaches the payload. " +
|
|
71
|
+
"Values built at runtime (C2 URLs, config, decoded strings) are very likely NOT " +
|
|
72
|
+
"recovered by this run or by static deobfuscation (webcrack) — even though box-js " +
|
|
73
|
+
"emulated without erroring and reported no network IOCs.",
|
|
74
|
+
remediation: "Do not read the absence of network IOCs as 'no C2'. Pivot to a method that runs the " +
|
|
75
|
+
"real relaunched instance: AMSI script-block logging on a Windows host/VM (the decoded " +
|
|
76
|
+
"payload surfaces in Event Viewer / Sysmon Event ID 4104), or manually resolve the " +
|
|
77
|
+
"runtime string-building routine (String.fromCharCode / XOR loops) in the webcrack " +
|
|
78
|
+
"output to reconstruct the assembled URL.",
|
|
79
|
+
},
|
|
53
80
|
{
|
|
54
81
|
name: "yara-family-attribution",
|
|
55
82
|
priority: 7,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"advisories.js","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CACvD,CAAC;YACF,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACtE,CAAC;YACF,OAAO,YAAY,IAAI,UAAU,CAAC;QACpC,CAAC;QACD,KAAK,EACH,kGAAkG;QACpG,WAAW,EACT,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACzD,OAAO,IAAI,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,wBAAwB;QACzD,CAAC;QACD,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,2FAA2F;KAC9F;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YAChD,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CACrE,CAAC;YACF,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACvF,CAAC;YACF,OAAO,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,EACH,oFAAoF;YACpF,uFAAuF;YACvF,oEAAoE;QACtE,WAAW,EACT,qFAAqF;YACrF,yFAAyF;YACzF,2FAA2F;KAC9F;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;oBAClB,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC/B,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EACH,uFAAuF;YACvF,yFAAyF;YACzF,mEAAmE;QACrE,WAAW,EACT,6FAA6F;YAC7F,6FAA6F;YAC7F,uCAAuC;KAC1C;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAwB;IAExB,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAClC,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"advisories.js","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CACvD,CAAC;YACF,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACtE,CAAC;YACF,OAAO,YAAY,IAAI,UAAU,CAAC;QACpC,CAAC;QACD,KAAK,EACH,kGAAkG;QACpG,WAAW,EACT,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACzD,OAAO,IAAI,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,wBAAwB;QACzD,CAAC;QACD,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,2FAA2F;KAC9F;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YAChD,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CACrE,CAAC;YACF,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACvF,CAAC;YACF,OAAO,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,EACH,oFAAoF;YACpF,uFAAuF;YACvF,oEAAoE;QACtE,WAAW,EACT,qFAAqF;YACrF,yFAAyF;YACzF,2FAA2F;KAC9F;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YAChD,0EAA0E;YAC1E,4EAA4E;YAC5E,yEAAyE;YACzE,6EAA6E;YAC7E,2EAA2E;YAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,MAAM;gBACR,iEAAiE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,KAAK,EACH,uEAAuE;YACvE,mFAAmF;YACnF,oFAAoF;YACpF,iFAAiF;YACjF,mFAAmF;YACnF,yDAAyD;QAC3D,WAAW,EACT,sFAAsF;YACtF,wFAAwF;YACxF,oFAAoF;YACpF,oFAAoF;YACpF,0CAA0C;KAC7C;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;oBAClB,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC/B,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EACH,uFAAuF;YACvF,yFAAyF;YACzF,mEAAmE;QACrE,WAAW,EACT,6FAA6F;YAC7F,6FAA6F;YAC7F,uCAAuC;KAC1C;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAwB;IAExB,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAClC,CAAC;AACJ,CAAC"}
|